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Summary 


Electronic patient record (EPR) systems have the potential to bring huge benefits to 
patients and are being implemented in health systems across the developed world. Storing 
and sharing health information electronically can speed up clinical communication, reduce 
the number of errors, and assist doctors in diagnosis and treatment. Patients can have 
more control of their own healthcare. Electronic data also have vast potential to improve 
the quality of healthcare audit and research. However, increasing access to data through 
EPR systems also brings new risks to the privacy and security of health records. 


In England, implementing EPR systems is one of the main aims of the 10-year National 
Programme for Information Technology (NPfIT), which was launched in 2002, building 
on earlier initiatives. The main plank of the NPfIT programme is the NHS Care Records 
Service (NCRS) which will create two separate EPR systems: a national Summary Care 
Record (SCR), containing basic information, and local Detailed Care Records (DCRs), 
containing more comprehensive clinical information. NCRS will also include a Secondary 
Uses Service (SUS) which will provide access to aggregated data for management, research 
and other ‘secondary purposes. 


Following delays, trials of the SCR are now taking place at a number of ‘early adopter’ sites. 
We found it difficult to clarify exactly what information will be contained in the SCR and 
what the primary uses of the record will be. The explanations eventually provided by the 
Department of Health showed that the SCR could have great clinical value in some 
situations. Therefore, although it will be less comprehensive than clinically rich DCR 
systems, we support the implementation of the SCR as soon as possible. 


The consent arrangements for creating and adding information to the SCR have not been 
well communicated to patients or clinicians. In particular, debate has arisen over whether 
an ‘opt-out’ or ‘opt-in’ system should be used. In fact, a hybrid consent system is now 
proposed: an ‘opt-out’ system will be used for the creation of the SCR, while the addition of 
clinical information will happen on an ‘opt-in’ basis. This is a satisfactory consent model 
but we recommend that much more is done to explain these arrangements, particularly to 
patients. 


Important components of the SCR have not yet been completed. “Sealed envelopes” will 
allow patients to restrict access to particularly sensitive information and are an important 
safeguard for patient privacy. Meanwhile the HealthSpace website will allow patients to 
access their SCR from home and has great potential for making care more patient-centred. 
We therefore recommend that both “sealed envelopes” and HealthSpace are implemented 
as soon as possible. We also make specific recommendations for improving these features 
of the SCR. 


Maintaining the security of the SCR and other NCRS systems is a significant challenge. 
Each SCR will be potentially available across the country to a wide range of different users, 
making operational security especially problematic. Connecting for Health, the 
organisation responsible for delivering NPfIT, has taken significant steps to protect 
operational security, including strong access controls and audit systems. However, the 
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impact of these measures in the complex environment of the NHS is difficult to predict. 
We recommend a thorough evaluation of operational security systems and security 
training for all staff with access to the SCR. 


DCR systems, which will allow local organisations to share detailed clinical information, 
are the “holy grail” for NPfIT. Such systems can improve safety and efficiency, support key 
activities such as prescribing, and vastly increase the effectiveness of clinical 
communication. In particular, DCR systems offer improvements to the care of patients 
with multiple or long-term conditions. It is on NPfIT’s success in delivering DCR systems 
that the programme’s effectiveness should ultimately be judged. 


_ In order to deliver DCR systems, Connecting for Health has set out to replace local IT 


systems across the NHS, as well as building the capacity to link these systems together. The 
new national broadband network has now been completed, but progress in other areas has 
been disappointing. In particular, the introduction of new basic hospital Patient 
Administration Systems (PAS) has been seriously delayed. One of the two main hospital 
PAS products, Lorenzo, will not be trialled in the NHS until 2008. As a result of these and 


| other delays, it is not clear when joined-up DCR systems will be widely available. 


In addition, we found it difficult to ascertain either the level of information sharing that 
| will be possible when DCR systems are delivered, or how sophisticated local IT 


applications will be. In its original specification documents in 2003, NPfIT established a 
clear vision for local electronic records systems. Four years later, however, the descriptions 
of the scope and capability of planned DCR systems offered by officials and suppliers were 


_ vague and inconsistent. Some witnesses suggested that parts of the original vision have 


been abandoned because of the difficulties of implementing new systems at a local level. 
We recommend that Connecting for Health publish clear, updated plans for the DCR, 
indicating whether and how the project has changed since 2003. We also recommend that 
timetables for completing DCR systems are published by all suppliers. 


An important cause of the delays to DCR systems has been the lack of local involvement in 
delivering the project. Hospitals have often been left out of negotiations between 


_ Connecting for Health and its suppliers, and found themselves, as one witness put it, at 


“the bottom of the food chain”. As a result, they have lacked the incentives or enthusiasm 
to take charge of deployments. Increasing local ownership is now a key priority for the 
programme. The NPfIT Local Ownership Programme is an important first step but does 
not go far enough. We make a number of detailed recommendations for increasing local 
ownership, including giving local organisations responsibility for negotiating with 
suppliers and for contract management, and offering users a choice of systems wherever 
possible. 


We recommend that Connecting for Health switch as soon as possible to focus on setting 
and ensuring compliance with technical and clinical standards for NHS IT systems, rather 
than presiding over local implementation. Clear technical standards will allow systems to 
be centrally accredited for use in the NHS, whilst giving local users the final say over which 
system is procured and how it is implemented. The GP Systems of Choice initiative is a 
good model for this approach. We also recommend that an independent technical 
standards body and a standards testing service be established to support this work. 
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Safe and effective data sharing, the fundamental aim of DCR systems, also requires a more 
standardised approach to the recording of clinical information. To this end, the agreement 
on a universal coding language for the NHS, SNOMED-CT, and a single unique patient 
identifier, the NHS number, are important achievements. We recommend that clear 
timetables are set for introducing SNOMED-CT and the NHS number across the health 
service. In addition, we recommend that Connecting for Health work with professional 
bodies to develop information standards for the recording of clinical data in the various 
specialities and care settings across the NHS. 


The development of the SCR and DCR will offer the SUS access to clinical data which are 
more timely, better integrated and of a significantly higher quality than those currently 
available. This is likely to transform the SUS and offers significant benefits, most notably 
for health research. However, researchers told us that more should be done to ensure that 
these opportunities are maximised. We make several recommendations for improving 
access to data for research purposes, including not only the single unique identifier, but 
also developing better linkage between new and existing databases. 


Increasing access to patient data also brings new challenges for safeguarding patient 
privacy, however. There is a difficult balance to be struck between the need to protect 
privacy and the opportunities for research, between safeguarding individual rights and 
promoting the public good. There are also a number of weaknesses within current access 
and governance systems. In particular, during the inquiry questions were raised about the 
extent to which pseudonymisation of data should be relied upon to protect privacy. We 
recommend that the Department of Health conduct a full review of both national and local 
procedures for controlling access to electronic health data for ‘secondary uses’. 





Despite some notable successes, the delivery of NCRS has in general been hampered by 
unclear communication and a worrying lack of progress on implementing local systems. 
Although Connecting for Health’s centralised approach has brought important benefits, it 
will increasingly need to be modified, particularly if the crucial DCR programme is to 
succeed. By clearly restating its aims, providing timetables and indicating how they will be 
met, and ensuring local organisations take charge of deployment, Connecting for Health 
can still ensure that NCRS is a success. 
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1 Introduction 


1. An important aim of most developed health systems is the creation, expansion and 
linkage of electronic patient record (EPR) systems. The introduction of EPR technology 
offers numerous and significant benefits. Storing and transferring patient information 
electronically has the potential to significantly reduce clinical errors and improve patient 
safety as well as allowing clinicians to communicate more quickly and accurately and to 
identify relevant information more easily. Good EPR systems can increase efficiency, 
reduce duplication and waste, and improve the cost-effectiveness of health services. EPR 
systems can also make information much more readily accessible to patients, allowing 
them to assume more control over their health records and thereby become more active in 
their own care. In addition, electronic databases of health information can be used for a 
range of purposes other than direct care provision, for example clinical audit and research. 
It is right to describe EPR as “potentially a transformative technology”.’ 

2. However, alongside these new opportunities, EPR systems also bring new risks, 
particularly to the privacy and safety of health information. Electronic systems allow access 
to data from many locations, increasing the likelihood of a security breach; they can also 
give individuals access to much more data than was previously possible, increasing the 
damage caused by system misuse. Personal health information is often highly sensitive, and 
it is therefore difficult to repair the damage caused by a breach of privacy. All these risks 
can be mitigated, but there is little doubt that EPR systems will create, as the European 
Data Protection Working Party acknowledged, “a new risk scenario” for personal health 
information.’ 


3. In the NHS in England, the development of EPR systems was given central direction and 
impetus by the instigation of the 10-year National Programme for Information Technology 
(NPfIT), the largest civilian IT project in the world, in 2002. In developing EPR systems, 
England is firmly in line with trends in the developed world: EPR systems are being created 
in various forms in the USA, Canada and Australia, as well as in Scotland, Wales and many 
countries in the European Union. 


4. The NHS Care Records Service (NCRS), and the infrastructure upgrades required to 
support it, are the central plank of the NPfIT project and account for the majority of 
planned expenditure. While most GPs and hospitals have long been using IT systems for a 
range of purposes, including patient record storage, NCRS seeks to expand and link 
together electronic data about patients, as well as significantly upgrading hardware, 
software and network infrastructure. Upgrading, replacing and linking existing records 
systems is intended to lead to the creation of electronic Detailed Care Records, available 
across local health economies. NCRS will also provide a separate Summary Care Record 
for each NHS patient, available throughout England. 


5. While the benefits of EPR systems are widely acknowledged, NPfIT’s implementation, 
and particularly the delivery of NCRS, has recently been subject to widespread questioning 


1 Ev 81 


2 See European Data Protection Working Party, Working Document on the processing of personal data relating to 
health in electronic health records (EHR), 00323/07/EN, WP131, p.5 
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and criticism. Delays of at least two years have affected the Summary Care Record project 
and the upgrades to Patient Administration Systems (PAS) required to support the 
Detailed Care Record. A report by the National Audit Office in June 2006 praised NPfIT’s 
initial contracting arrangements but criticised the lack of information about when new 
systems were likely to be implemented. In March 2007, the Public Accounts Committee 
concluded that there is still “much uncertainty” about when and what NPfIT will deliver, 
highlighting ongoing delays to NCRS. Meanwhile, the piloting of the new Summary Care 
Record system, which began in spring 2007, has sparked public debate about the privacy 
and security of the new systems. Academics, the media and growing numbers of clinicians 
and patients have all expressed serious doubts about the organisation and performance of 
NPfIT. 


6. In light of these wide-ranging and serious concerns, and of the great benefits to patient 
care offered by EPR systems, the Committee decided in February 2007 to hold an inquiry. 
Rather than examining the whole of the NPfIT project, we chose to focus on the NCRS 
project, the most expensive, most ground-breaking and most controversial element of the 
programme. Our terms of reference were as follows: 


e What patient information will be held on the new local and national electronic 
record systems, including whether patients may prevent their personal data being 
placed on systems; 


° Who will have access to locally and nationally held information and under what 
circumstances; 


e Whether patient confidentiality can be adequately protected; 


¢ How data held on the new systems can and should be used for purposes other than 
the delivery of care e.g. clinical research; and 


e Current progress on the development of the NHS Care Records Service and the 
National Data Spine and why delivery of the new systems is up to two years behind 
schedule. 


7. The Committee received more than 70 written evidence submissions from academics, 
lawyers and IT companies, as well as a number of staff and patient groups. The 
Department of Health provided an initial memorandum in March 2007 and sent 
additional submissions on 12 June and 16 July. We held oral evidence sessions between 
April and June 2007, hearing from, amongst others, civil servants, doctors, lawyers, IT 
suppliers, patient groups, the Assistant Information Commissioner and the Minister of 
State for Quality. The Committee also visited Nashville, Ottawa, Amiens, Paris and 
Hackney in order to look at and discuss EPR systems. 


8. Our report considers the issues raised by the inquiry under the following headings: 
e Overview of EPR systems; 
e The Summary Care Record; 


e The Detailed Care Record; and 


The Electronic Patient Record 9 


e The Secondary Uses Service. 


9. The Committee would like to thank those who submitted evidence and those we met 
during our visits, as well as the staff of the Foreign and Commonwealth Office who made 
these visits possible. We are particularly grateful for the expert advice which we received 
from our specialist advisors Professor Ross Anderson, Dr Jem Rashbass and Professor John 
Williams. 
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2 Overview of EPR systems 








Background 


10. NHS organisations have long made use of a wide range of IT systems. However, levels 
of computerisation have generally varied considerably between, and often within, 
organisations and tiers of care. As a broad outline, the following characteristics have been 


typical: 


General practitioners have had the highest level of computerisation with the vast 
majority of surgeries using IT systems both for administrative and clinical 
purposes. Most practices have stored some patient information electronically, and 
many have dispensed with paper systems altogether after scanning old paper notes 
into new electronic systems. The new GMS contract, introduced in 2004, 
consolidated the high level of IT usage in general practice by requiring payments 
and performance assessment to be processed electronically.’ 


In hospitals, the level of computerisation has varied widely but has been 
consistently lower than in general practice. All NHS hospitals have used basic 
Patient Administration Systems (PAS) for a number of years for administrative 
purposes such as scheduling, recording admissions and discharges, and storing 
patient demographic and basic diagnosis information. In some clinical areas, such 
as theatres and pathology, more sophisticated systems have often been used for 
both administrative and clinical purposes. However, the use of more complex 
systems capable of recording all aspects of clinical care has been extremely rare, 
and the overwhelming majority of patient records have been stored in often 
voluminous paper notes.* The lack of unifying standards and a piecemeal approach 
to procurement has meant that IT systems in different departments within a single 
hospital have often been unable to communicate with each other. 


Amongst community and mental health care providers, levels of IT use have 
been the lowest of all. Many such organisations have not used computers even for 
administrative purposes and have stored all patient records on paper. 


More complex systems have been developed in some parts of the country across 
clinical networks with responsibility for a particular patient group. For example, 
shared databases and other IT systems have been used at local level by cancer, 
diabetes and renal networks. 


11. In general NHS IT systems have been characterised by an inability to share information 
between different organisations, between primary and secondary care, and often between 








3 Under the GMS contract, responsibility for supplying GP IT systems was passed from individual practices to PCTs. 


4 There have been some exceptions to this rule, for example the successful implementation of the Millennium system 
at Homerton and Newham hospitals in London and the installation of EPR systems at the Wirral Hospital - see Q 


577. 
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different parts of the same organisation. The situation was likened by one witness to a 
series of “electronic islands” with little ability to communicate.® 


12. In 1998, the Government launched an NHS information strategy, Information for 
Health. The strategy was intended to run until 2005 but was superseded in 2002 by NPfIT. 
Information for Health’s goals included: 


e The creation of an electronic health record, containing “lifelong core clinical 
information” for each NHS patient, by 2005, developed initially by linking local 
primary care systems; and 


e Establishing “level 3” electronic patient record systems in all hospitals by 2005 (to 
include electronic ordering, reporting, prescribing and care management).’ 


The National Programme for Information Technology 


13. In June 2002, the Department of Health published Delivering 21* century IT support for 
the NHS: national strategic programme, effectively the blueprint for the National 
Programme for Information Technology (NPfIT). The strategy restated the importance of 
the goals set out in Information for Health but acknowledged that progress had been 
hampered by lack of protected funding, lack of central direction, poor value for money and 
a shortage of network capacity.® 


14. Delivering 21% Century IT proposed to address these problems through a more 
centralised, national approach to NHS IT, linked to the ambitious goals and generous 
funding increases embodied in the 2000 NHS Plan.’ The document stated: 


The core of our strategy is to take greater central control over the specification, 
procurement, resource management, performance management and delivery of the 
information and IT agenda. We will improve the leadership and direction given to 
IT, and combine it with national and local implementation that are based on ruthless 
standardisation."® 


What NPfIT aims to deliver 
15. The initial aims of the project were to establish three main systems: 
¢« An Electronic Transfer of Prescription service (ETP); 


e An electronic appointment booking service (subsequently expanded in scope to 
become Choose and Book); and 


6 Q102 


7 NHS Executive, Information for Health: An Information Strategy for the Modern NHS 1998-2005, September 1998, 
p.110. The strategy set out 6 different levels of EPR to be achieved by hospitals, ranging from level 1, “Clinical 
Administrative data”, through to level 6, “Advanced multimedia and telematics”, p.37. 


8 Department of Health, Delivering 21** Century IT support for the NHS: national strategic programme, June 2002, p.1 
9 Ibid, p.1 
10 Ibid, p.i 
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« The NHS Care Records Service (NCRS), including a detailed electronic patient 
record to be shared by local organisations and a summary record, available 
nationally.” 


16. The programme’s initial aims also included major upgrades to existing software and 
network infrastructures, including the following: 


° The creation of a private broadband network to link all NHS organisations to the 
national system, known as the New National Network for the NHS (N3); 


¢ The development of a National Data Spine to store information centrally, to link 
local and national IT systems and to host national systems such as the Summary 
Care Record; and 


e The widespread installation, replacement or upgrading of basic computer systems 
across the NHS, including PAS software for hospital and community providers and 
new or upgraded systems for GPs. 


17. In order to achieve these goals, the Department of Health agreed a number of contracts 
with a range of private suppliers in 2003 and 2004. The main contracts are shown in the 
table below: 
















Fast and reliable network to British Telecom 
enable communication within 
and between NHS 
organisations. The foundation 


of the rest of the NPfIT project. 


New National 
Network for 
the NHS (N3) 




























National 
Data Spine 


Database which holds patient British Telecom 
demographic information, 
national electronic patient 
record (Summary Care Record) 


and enables communication 


= = 
National Dec 2003 
between national and local 
NPfIT systems. 


National | Links GP and hospital! systems to | Atos Origin Oct 2003 
allow electronic booking of 
appointments. 


NHSmail NHS-wide e-mail service. Cable & Wireless | July 2004 50.90 | 


Local Service | Regional | Provision of NHS Care Records Computer Dec 2003 
Provider — Service, new Patient Sciences 
Administration Systems and Corporation 
prescribing (ETP) systems across | (Accenture until 
the region. Sep 2006) 
Local Service | Regional | Provision of NHS Care Records British Telecom Dec 2003 


North East 
11 Full details of the original specification for the NCRS, which also included a range of local clinical IT systems, can be 


found at National Programme for Information Technology, Output Based Specification Version Two, Integrated Care 
Records Service, 1 August 2003. 










Choose and 
Book 






















The Electronic Patient Record 13 
Administration Systems and 
prescribing (ETP) systems across 


London 
the region. 
Local Service | Regional | Provision of NHS Care Records Computer Dec 2003 | 934 
Provider — Service, new Patient Sciences 
Eastern and Administration Systems and Corporation 
East Midlands prescribing (ETP) systems across | (Accenture until 
the region. Sep 2006) 
Local Service | Regional | Provision of NHS Care Records Computer Dec 2003 | 973 
Provider — Service, new Patient Sciences 
North West Administration Systems and Corporation 
and West prescribing (ETP) systems across 
Midlands the region. 
= . 


Table 1: Main NPfIT contracts 
Source: National Audit Office 

18. Since 2002, the scope of NPfIT has increased as a number of additional services have 
been added to the original specification. These include: 













Provision of NHS Care Records 
Service, new Patient 
Administration Systems and 
prescribing (ETP) systems across 
the region. 


Local Service 
Provider — 
South 
















e Digital capture and storage of X-rays and other diagnostic results through the 
installation of Picture Archiving and Communications Services (PACS) in acute 
hospitals; 


e Automation of assessment of GP practice performance against the new GP 
contract using the Quality Management Analysis System (QMAS); and 


e A system (known as GP2GP) for moving patients’ GP records instantly from one 
practice to another when a patient switches practice. 


How the programme is organised 


19. In contrast with previous NHS IT strategies, NPfIT involves the procurement of new 
systems and services at a national level rather than by individual NHS organisations. In 
2005, responsibility for NPfIT was transferred from the Department of Health to an arms- 
length body, NHS Connecting for Health. Thus all of the contracts listed in table 1 were 
agreed on behalf of the NHS by the Department of Health and are now held and managed 
by Connecting for Health. The majority of new systems will be installed in local NHS 
organisations, but suppliers are answerable to Connecting for Health, a national 
organisation. Connecting for Health is currently transferring some responsibility for 
contract management to the 10 regional Strategic Health Authorities (SHAs) through the 
NPfIT Local Ownership Programme (NLOP), which we discuss in Chapter 4. 
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20. Since its inception, the project has been headed by Richard Granger, inaugural Director 
General for IT in the NHS. Mr Granger announced in June 2007 that he would leave his 
post by the end of the year.” 


21. Department of Health and Connecting for Health officials praised the centralised 
organisation of the programme, arguing that the introduction of national-level 
procurement in 2002 had led to a step change in progress on the delivery of new IT systems 
to the NHS. They pointed out that the centralised approach had led to: 


e Better value for money because of national procurement: officials argued that local 
procurement of systems had generally proved unaffordable in the past;’° 


e Much more consistent development of IT across the NHS, in contrast with the 
previous “electronic islands”; 


e Greater potential for interoperability between systems than if a more localised 
approach had been taken.”” 


22. Defending the centralised approach to the programme, Richard Granger was especially 
critical of progress prior to the inception of NPfIT: 


...the progress that had been made was lamentable—and yet at very significant cost 
of about a billion pounds a year at 2002. The revisionists are busy at work now trying 
to make out the progress that had been achieved before 2002 was extremely good 
and has somehow been retarded by the introduction of national systems; but the 
evidence does not substantiate that viewpoint." 


23. As table 1 demonstrates, some of the main NPfIT contracts cover services to be 
provided nationally across the whole of the NHS, such as the N3 network and the National 
Data Spine (which includes the Summary Care Record). Contracts are also in place for the 
provision of services across regional areas. For this purpose, the NHS was divided into five 
geographical ‘clusters’, for each of which a Local Service Provider (LSP) contract was 
agreed. LSPs were contracted to provide a wide range of services to organisations across 
their ‘cluster’, including new PAS systems and the other services which will contribute to 
the Detailed Care Record. The five LSP contracts made up 80% of the value of the initial 
contracts (around £5 billion of the total value of £6.3 billion). The five ‘clusters’ and their 
LSPs are shown below: 





12 See Personal statement regarding Richard Granger, Connecting for Health press release, 6 June 2007 
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Primary supplier: Accenture 
(transferring to CSC) 
Contract Value: £1,099m 
Duration: 10 Years 













Primary supplier: CSC 
Contract Value: £973m 
Duration: 10 Years 





Primary supplier: Accenture 
(transferring to CSC) 


Contract Value: £934m 
Duration: 10 Years 












Primary supplier: Fujitsu 
Contract Value: £996m 
Duration: 10 Years 









Southern Cluster es Primary supplier: BT 
Contract Value: £996m 
Duration: 10 Years 





Figure 1: The 5 regional NPfIT ‘clusters’ 


24. The five LSP contracts were originally awarded to four different suppliers, with 
Accenture holding two of the five contracts. However, Accenture withdrew from the 
programme in September 2006 and its two LSP contracts were transferred to Computer 
Sciences Corporation (CSC), one of the existing LSPs.'? Thus CSC now holds three of the 
five LSP contracts with the others continuing to be held by Fujitsu and BT. BT also holds 
the two major contracts for supplying services at a national level, those for the N3 network 
and the National Data Spine. 


25. LSPs have subcontracted some areas of their work to smaller, more specialised 
companies. In particular, the development of new PAS software for hospitals and 
community care providers has generally been outsourced. In the three clusters now under 
CSC, the Lorenzo PAS system is being provided by iSoft, a UK software firm.’* In the 
London and Southern clusters, a Common Solution Project was initially formed between 
BT and Fujitsu to procure PAS systems from the US software supplier IDX. However, the 
partnership was subsequently dissolved and both LSPs subsequently switched from IDX to 
another US firm, Cerner, as their main PAS system supplier.’ Cerner will supply the 
Millennium PAS system.” 


26. The current suppliers for new hospital PAS software are shown in the table below: 


17. See Changes to delivery of NHS National Programme for IT, Connecting for Health press release, 28 September 
2006 
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Cluster Local Service Provider —_ | PAS system 
BT 


London 





PAS system supplier 


Cerner (IDX until July 2006) 


Southern Fujitsu Cerner (IDX until April 
2005) 
Midlands 





Eastern 


Midlands 





Table 2: Hospital PAS suppliers by cluster 
Source: National Audit Office 


Progress to date 


27. Assessments of NPfIT’s overall progress to date have varied widely. The Department of 
Health’s evidence submission provided an upbeat assessment of progress: 


[NPfIT] is already providing essential services to support patient care and the 
smooth running of the NHS, without which it could not now properly function. 
Installation of a modern, high speed, secure infrastructure and national network 
[N3] has been completed ahead of schedule and is daily supporting millions of 
business transactions in the NHS...Widespread coverage of Community Patient 
Administration Systems has been achieved where nothing existed before. Over half 
of hospitals now have digital x rays and scans.?! 


28. Richard Granger offered the Committee a range of statistics to demonstrate the scale of 
progress: 


We now have 19,000 places connected up, so we have one of the biggest virtual 
private networks on the planet and people take that for granted. We are now 
computerising, to deliver prescriptions safely, 200 GP practices a week with the 
relevant software. We typically move 120,000 prescriptions electronically now on any 
given day. About every 10 seconds a patient gets a booking completed 
electronically.” 


29. Evidence from suppliers was equally positive about progress. BT, both the supplier of 
the main national systems and the LSP for London, provided a clear timetable for 
completion of their contracted elements of the programme: 


The foundations of the NPfIT system provided by BT are now built, operating and 
secure. Culturally integrating these systems so they become second nature for NHS 
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staff is well underway. Over the next five years, the goal is to complete this 
programme.” 


30. A report by the National Audit Office (NAO), published in June 2006, however, was 
notably less bullish. While commending the “substantial progress” achieved by the 
programme, the NAO also acknowledged that implementation “continues to present 
significant challenges”.™ In particular, the NAO report highlighted: 


delays of ten months to the delivery of the National Data Spine and around two 
years to the launch of the Summary Care Record, both the responsibility of BT;” 
and 


delays of between one and two years to the delivery of systems by LSPs.” The 
Department of Health has acknowledged that the installation of new hospital PAS 
systems, one of the key responsibilities of the LSPs, is now “up to two years behind 
schedule”.”” 


31. The subsequent report from the Public Accounts Committee (PAC), published in 
March 2007, expressed further doubts. In particular, the PAC highlighted: 


Two-year delays to both the national and local elements of the NHS Care Records 
Service, pointing out that “no firm implementation dates exist” for these elements 
of the programme; 


The failure to quantify the benefits which the programme will deliver; 


A lack of capacity amongst suppliers, exacerbated by the withdrawal of Accenture, 
and an over-reliance on two main software suppliers, Cerner and iSoft, for delivery 
of key elements of the programme; 


The lack of effective communication with clinicians by NP£IT’s leaders and failure 
to clarify the roles of local NHS organisations in the delivery of the programme; 
and 


A narrow focus on the delivery of new systems rather than the “broader process of 
business change” required to maximise benefits.” 


The PAC concluded that, 


23 
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At the present rate of progress it is unlikely that significant clinical benefits will be 
delivered by the end of the contract period.” 


National Audit Office, Department of Health: The National Programme for IT in the NHS, HC 1173, 16 June 2006, p.6 


Ibid, p.4 
Ibid, pp.18-23 
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Public Accounts Committee, Twentieth Report of Session 2006-07, Department of Health: The National Programme 
for IT in the NHS, HC 390, pp.5-7 
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32. Estimates of the likely overall costs of the programme have also varied substantially. As 
shown in table 1, the cost to the NHS of the main initial contracts will be £6.3 billion over 
the 10 years of the contract. However, the NAO estimated in its report that the total cost of 
implementation, including expenditure by local organisations, will be £12.4 billion.” In its 
response to the Health Committee’s 2006/7 Public Expenditure Questionnaire, the 
Department of Health estimated the total net cost of NPfIT at £7.5 billion, after accounting 
for an estimated £4.2 billion of cost savings as a result of the national programme.” 


The NHS Care Records Service 


33. At the heart of NPfIT is the NHS Care Records Service (NCRS), a set of projects which 
eventually aim to provide detailed electronic patient records across the NHS which can be 
shared between different clinicians, organisations and tiers of care. The majority of the 
expenditure on the programme, including the creation of the National Data Spine and the 
replacement of local PAS systems across the NHS, is in support of the NCRS. As the PAC 
put it, the NCRS is “central to obtaining the benefits of the programme”. The Department 
of Health described NCRS as the “cornerstone” of NPfIT.”° 


What NHS Care Records Service aims to deliver 


34. The NCRS will be made up of a group of systems with distinct functions and purposes. 
These are: 


e The Personal Demographics Service (PDS), an application supported by the 
National Data Spine, which is already in widespread use. * The PDS contains basic 
demographic details about every NHS patient including name, address, date of 
birth, NHS number and current GP.*° 


e The Summary Care Record (SCR), which is also supported by the Spine and is 
currently being piloted in the Northwest. The SCR will be a high-level record of key 
clinical information including allergies, prescriptions, summary medical history, 
operations and procedures. An SCR will be created for every NHS patient, 
although patients can choose to opt out, and will be potentially available 
throughout England. We examine the SCR in Chapter 3.*° 


e Local record systems, on which comprehensive patient records will continue to be 
stored in hospitals, GP surgeries and other organisations. Many of these systems 
will be replaced or upgraded as part of NPfIT and paper systems will increasingly 





30 National Audit Office, Department of Health: The National Programme for IT in the NHS, HC 1173, 16 June 2006, p.4 


31 Health Committee, Public Expenditure on Health and Personal Social Services 2006: Memorandum received from the 
Department of Health containing Replies to a Written Questionnaire from the Committee, HC 1692-i, p.102 


32 Public Accounts Committee, Twentieth Report of Session 2006-07, Department of Health: The National Programme 
for IT in the NHS, HC 390, p.5 


33 Ev 117 (HC 422-III) 


34 See Ev 4-5: the Department of Health described the PDS as a “key component” of NCRS and stated that the system 
already transfers 6.5 million messages per week to and from users across the NHS. 


35 The PDS replaces the National Strategic Tracing Service, which had many similar functions. 
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be replaced by electronic systems. In hospitals, for example, new PAS systems will 
be installed to fulfil a range of largely administrative functions, followed by more 
detailed clinical systems which will in time reduce reliance on paper records. Local 
systems will feed a subset of information into both the Summary Care Record and 
Detailed Care Record systems, and as such will remain the foundation of the 
records service.*” 


The Detailed Care Record (DCR), which will be created by combining 
information from local systems and will hold significantly more detailed clinical 
information than the SCR. It will be created by linking or sharing information 
from the systems used by local providers (GPs, hospitals, community providers 
and others) to produce a single, detailed electronic record which can be shared 
across the local health economy. This means that some patients may have more 
than one DCR if they have been treated at organisations in different parts of the 
country. The DCR is likely to contain details of past and current conditions, 
assessments, diagnoses, treatments and care plans.** The systems which will make 
up the DCR are being provided by LSPs.*? We look at the DCR in Chapter 4. 


The Secondary Uses Service (SUS), which will collect, manage and analyse 
electronic health data from a range of sources, eventually including the new NCRS 
systems. The SUS will provide a single point of access to aggregated data for 
purposes including management, commissioning, clinical audit and research. An 
early version of the SUS is already in operation, using datasets such as Hospital 
Episode Statistics to support management functions such as Payment by Results.” 
However, the development of the NCRS will vastly increase the depth and breadth 
of data available through the SUS by allowing clinical data to be obtained directly 
from operational EPR systems.” 


Progress to date 


35. The delivery of the NCRS systems relies on the success of a number of related NPfIT 
projects, particularly the upgrades to network and software infrastructure. For example, the 
new NCRS systems will be underpinned by a number of national applications including 
the N3 network, the National Data Spine and the Personal Demographics Service. The 
DCR can only begin to take shape once the mass upgrades to hospital and community PAS 
systems have been completed, a task which is proving complex and time-consuming.” 
Similarly, the benefits of the SUS can only be maximised once the other NCRS systems are 
in place and operating successfully. Although their functions are distinct, the NCRS 
systems are reliant on each other, and on other NPfIT projects, both for their delivery and 
for their ultimate usefulness. 
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The exact data requirements for the DCR will need to be determined for each clinical specialty and stancard 
datasets will need to be agreed. We discuss this further in Chapter 4. 
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36. As stated above, the PDS and SUS are now operational, although the range of data 
available to the SUS remains limited. Following a two-year delay and intervention from a 
Ministerial Task Force, the SCR is now being piloted at GP practices in the Bolton area, 
although it is not clear exactly when the system will be made available throughout England. 
The timetable for delivering the DCR remains unclear, largely because of delays to the new 
Millennium and Lorenzo hospital PAS systems, as well as the replacement of IDX with 
Cerner as the main software supplier to the London and Southern clusters. An early 
version of Cerner’s Millennium system has now been deployed at some hospitals, but 
iSoft’s Lorenzo system is yet to be deployed anywhere. Until such basic systems are in 
place, the development of the shared DCR cannot begin. More detail about progress on the 
main NCRS systems is provided in Chapters 3, 4 and 5 below. 


International comparisons 


37. The NCRS is one of a number of EPR systems being implemented across the developed 
world. During our inquiry, we visited three other countries currently undertaking major 
EPR projects: 


e Canada, where efforts to create a Private Lifetime Record for each citizen are 
being co-ordinated by Canada Health Infoway (CHI). CHI aims to establish 
an electronic record for 50% of Canadian citizens by the end of 2009;* 


e France, where legislation to create a Dossier Médicale Personnel (DMP) was 
passed in June 2004. The DMP will contain a range of health information 
which can be viewed online. Access will be controlled by patients who will 
legally own their record. The DMP system is being implemented between 
2006 and 2010 at an estimated cost of €1.2-1.5 billion; and 


e The United States, where a number of integrated electronic records systems 
already exist, for example the VistA system used by the Veterans Affairs 
Administration. In 2004, President Bush set out the goal of establishing 
electronic health records for “most” US citizens by 2014. 


38. The situation in these three countries is similar in many ways to that in England. In 
general: 


e There are low rates of IT use and investment in healthcare compared with 
other sectors of the economy; indeed, more information about patients is 
generally stored electronically in England, especially in GPs’ surgeries, than in 
the other countries; 


¢ There are islands of excellence. For instance, at the Children’s Hospital of the 
Vanderbilt University Medical Center in Nashville, USA, there is an EPR 
system for inpatients and outpatients. We saw a number of technologies, 
including StarChart which allows faster access to patient data such as lab 








43 See www.infoway-inforoute.ca/en/home/home.aspx for more details 
44 See www.d-m-p.org/ 


45 See www.govtech.com/gt/91029 
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results and radiology reports; and WizOrder, a “computer physician order 
entry system”, which can help guide drug dosing for patients and check for 
allergies.*° An online portal allows patients to access the results of most tests, 
and to send messages to their doctor; 


¢ There are plans to introduce a summary electronic patient record in Canada 
and France. In Canada, CHI is overseeing the introduction of the ‘Private 
Lifetime Record’, which will include high level information about the patient’s 
medical, medication and immunisation history, including diagnostic 
information such as X-rays and lab results. The information will be accessible 
from hospitals, community health centres and GP offices. Eventually, patients 
will be able to access their information from home.’ In France, the national 
DMP will gather data from a range of local systems including hospitals, 
community providers and pharmacies into a single record. The DMP will 
include medical notes, images and prescription information and a section for 
patients to record information;** and 


¢ Ensuring interoperability and consistent clinical information standards are 
important goals. In Canada, a range of local systems will continue to be used 
in hospitals and elsewhere, but they must be able to exchange information 
with the EPR. All information will be stored in coded form using SNOMED 
CT clinical codes. In France, the success of the DMP depends on 
organisations having local systems, such as that at Amiens, which can interact 
with the national system. There is a long way to go with this: for example, only 
a third of French hospitals have digital imaging systems. In the USA, Regional 
Health Information Organisations have been established to promote the 
sharing of information. 


39. However, a significant difference between England and these other countries is that 
existing IT systems are being replaced by new IT systems purchased centrally by 
Connecting for Health on behalf of hospitals and other local organisations. This is possible 
largely because the majority of providers in England form part of the NHS. In France and 
Canada, independent healthcare providers will purchase their own systems which must be 
interoperable with national systems. In the US, the Certification Commission for 
Healthcare Information Technology aims to encourage healthcare providers to purchase 
accredited, interoperable systems.” 


Conclusions 


40. The National Programme for IT (NPfIT) is a complex and ambitious set of projects 
intended to transform the use of information technology in the NHS. At the heart of 
the programme is the NHS Care Records Service (NCRS), which aims to introduce a 
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range of electronic patient record (EPR) systems. EPR systems offer significant 
potential improvements to the safety, quality and efficiency of care and are being 
implemented in most health systems in the developed world. 


41. NPfIT is characterised by a centralised management structure and large-scale 
procurement from private suppliers. This approach aims to offer improved value for 
money and to address the previously patchy adoption of IT systems across the health 
service. The Department defended the progress made by NPfIT to date, arguing that 
the programme is on course to succeed. However, serious doubts have been raised, 
from sources including the Public Accounts Committee, about how much has been 
achieved and about the likely completion date. In particular, progress on the 
development of the NCRS has been questioned. 


42. During our inquiry, both at home and abroad, similar messages were given to us 
repeatedly from different sources. We commend these to the Department: 


e The EPR is essential and is the top priority for improving health care. 


¢ The installation of a comprehensive IT system is a long journey best 
managed by a staged and piloted development not a big bang approach. 


e The input of end-users is vital in planning, design and implementation. 


e Local flexibility is essential to allowing continued use of effective systems 
already in place, as is interoperability if local systems are to communicate 
with one another. 


e As EPR systems make more personal health data accessible to more people, 
breaches of security and confidentiality must be regarded as serious 
matters. 


¢ The support of the public must be obtained. The fact that EPR systems are 
essential for the delivery of modern health care and can improve 
communication between different health care staff and between staff and 
patients must be adequately publicised to users of the NHS. We believe this 
would help to convince people of the necessity and benefits of the EPR and 
reduce resistance where it exists. 
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3 The Summary Care Record 





Introduction 


43. In this chapter we examine the development of the national Summary Care Record 
(SCR) under the following headings: 


¢ A description of the SCR, including the content of the record, the situations in 
which it will be used and the reasons for developing a national summary record; 


e Progress on the development of the SCR and the timetable for completing the 
project; 


¢ Plans for patient consent systems for the creation of the SCR record and for 
adding information to the record; and 


¢ The security systems which will be used to ensure that SCR information is held 
safely, including technical and operational security systems. 


Description 


General 


44. The SCR is intended to provide a summary of key health information, which can 
potentially be accessed by clinicians anywhere in the country. An SCR will eventually be 
created for every NHS patient in England, provided they do not choose to opt out of 
having a record. Unlike the Detailed Care Record (DCR), every patient’s SCR can be made 
accessible in all parts of the NHS to users with the appropriate level of access. Information 
held in the SCR will be extracted from existing GP records, and later from other sources, 
and uploaded to and stored on the National Data Spine. 


45. The SCR is one of the main Spine applications being developed by BT and works 
alongside another Spine application, the Personal Demographics Service (PDS). PDS data 
will be used to determine all of the patients for whom an SCR is to be created and to ensure 
that duplicate records are not created. Use of the SCR requires NHS organisations to be 
connected to the Spine via the N3 network.” 


46. Patients will be able to access their own SCR data on the internet using a website called 
HealthSpace. HealthSpace will allow patients to view but not alter information, to add their 
own notes and comments to the SCR record, and to access more detailed background 
information, for example on diagnoses and treatments.” 


50 Officials told the Committee that there are now more than 19,000 N3 connections in hospitals, GP surgeries and 
other facilities across the health service: see Q2. 
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Content of the Summary Care Record 


Officials’ views 


47. Determining exactly what information would be held on the new NCRS systems was 
one of the main aims of the Committee’s inquiry. However, the information and 
explanations which we received from Connecting for Health about the content of the SCR 
changed markedly during the course of our inquiry. Initially, in its memorandum 
submitted in March 2007, the Department told us that: 


At first, the Summary Care Record will contain only basic information such as 
known allergies, known adverse reactions to medications and other substances (e.g., 
peanuts) acute prescriptions in the past 6 months and repeat prescriptions that are 
not more than six months beyond their review date...In due course more 
information will be added about current health conditions and treatment.” 


48. However, when questioned in detail on 26 April about the content of the SCR, 
Connecting for Health officials described the content as “customisable at a local level”, 
implying that different information will be placed on the SCR in different parts of the 
country.*? Dr Gillian Braunold, National Clinical Lead for GPs at Connecting for Health, 
stated at the same evidence session that some information from hospital records will be 
placed on the SCR. 


49. Officials provided more detailed and somewhat different information at the evidence 
session on 14 June. Dr Simon Eccles, National Clinical Lead for Hospital Doctors at 
Connecting for Health, described three distinct sets of information that could be placed on 
the SCR: 


e Information on allergies, adverse drug reactions and recent prescriptions, 
described as “life-saving” information, derived from the patient’s GP record. This 
information will be placed on the SCR when it is created; 


e More detailed information about basic medical history, key operations and 
procedures, physiological and lifestyle details, which can subsequently be added to 
the SCR, again derived from the GP record; and 


e Basic details of hospital visits including discharge summaries, outpatient clinic 
letters and A&E summaries, which can be placed on the SCR from 2008.55 


Other views 


50. Witnesses expressed concerns about the Department’s changing descriptions of the 
content of the SCR. In addition, some argued that the inclusion of more and more data 
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would erode the value of the record as a brief but clinically useful summary.*° Other 
witnesses thought that patient consent systems would be undermined by the expansion in 
the content of the SCR, something we consider in more detail below. Dr Paul Cundy, Chair 
of the General Practitioners’ Committee Joint IT Committee, stated that, 


We are aware that there are already, even before the evaluation of the pilots is 
completed, suggestions that the Summary Care Record should also collect data from 
Choose and Book (i.e. referrals data) and also possibly the electronic prescriptions 
service. So it is already looking like far more than just a summary record.” 


51. Other witnesses were scathing, particularly about the perceived inconsistency of the 
information received from Connecting for Health. Joyce Robins of Patient Concern 
commented that, “the grave impression is that they are making it up on the hoof’. 


Uses of the Summary Care Record 


Officials’ views 


52. The way in which the SCR will be used depends upon what information is included. It 
is not surprising, therefore, given the uncertainty about the content of the record, that a 
number of different uses for the SCR were described to the Committee. Dr Gillian 
Braunold told the Committee that: 


The Summary Care Record is intended to be a first cut of information to help 
clinicians who have no access to any other records in the first instance who are 
unfamiliar with the patient, to help them to get started so they are not working in an 
absence of information.” 


53. Officials suggested that the SCR would be of particular value in providing care to the 
following patient groups: 


¢ patients travelling regularly around England; 

e unconscious patients receiving emergency care; 

e unscheduled care for frail, elderly patients in the community; and 
¢ patients being treated out of hours.” 


54. Subsequently, Dr Braunold also described plans to use the SCR to provide continuous 
care for patients with long-term conditions as well as supporting unscheduled care. She 
commented that: 


Ce ee eo EEEEEEEEE 
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...one of our early adopter PCTs...is planning to use the Summary Care Record to 
help the people who are looking after patients with diabetes in the community, as 
well as in hospital and general practice; and they want to ensure that the content of 
the Summary Care Record will help to manage that care, and will have in it the 
recent results and the recent visits to the various members of the team.” 


55. Dr Braunold went on to argue that the SCR could be used to fulfil some of the 
functions of the DCR while the latter is being developed: 


My personal belief is that the amount of information in the Summary Care Record 
will start growing bigger and then go smaller again as the Detailed Care Records 
become the actual way that in the locality people start to share information...” 


Other views 


56. However, other witnesses expressed serious concerns about widening the uses of the 
SCR in this way, arguing that such practices would undermine both consent systems and 
security procedures. Dr Martyn Thomas, Professor of Software Engineering at Oxford 
University, stated: 


The notion that you could introduce a Summary Care Record and then use it as the 
Local Care Record, because it had the flexibility to enable local care groups to upload 
whatever information they wanted to and could agree to actually share amongst 
themselves, looks to me like a specification creep that is highly likely to undermine 
the security policies that are being put in place...© 


HealthSpace 


57. Officials were at least somewhat clearer about the intended use of the HealthSpace 
website. Patients will be able to use the site to gain access to their SCR and to look at more 
detailed, generic information about their conditions and treatments, as well as general 
health information. Patients will also be able to add their own notes and comments to their 
HealthSpace record.™ 


The benefits from a summary record 


Critical views 


58. The evident confusion over the content and likely uses of the SCR led some witnesses 
to question the value of having separate national SCR and local DCR record systems. One 
witness described the separate record systems as “an ill-defined fudge”. Frank Burns, 
author of the 1998 Information for Health strategy, argued that the introduction of the SCR 
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before local DCR systems have been implemented represented “an enormous distortion of 
priorities”. He argued that: 


..-it [the SCR] is of less value clinically and less value to patients than the deployment 
of clinically rich functional technology supporting doctors and nurses on a day-to- 
day basis.*” 


59. Dr Paul Cundy thought that the development of two separate records systems 
represented a departure from NPfIT’s original plans which envisaged a single, integrated 
record, available nationally: 


...your Committee is recognising the volte-face of the programme, because certainly 
it was true in 2003, when it was first announced as a national programme, it was 
going to be a single record accessible to anyone anywhere...We now have a very 
different description...® 


Officials’ views 


60. Officials disagreed, however, arguing that the goals of the NCRS have been consistent 
since the inception of NPfIT. Richard Granger told the Committee that the development of 
a separate SCR and DCR: 


...1S not a change of direction; that is the details of plans which were documented in 
Spring 2002...That document set out very clearly that there needed to be more 
widely accessible summary information and detailed local information... 


61. More importantly, officials stressed the clinical value of the SCR dataset, particularly 
“life-saving” information about allergies, adverse drug reactions and prescription 
information.” Harry Cayton, National Director for Patients and the Public at the 
Department of Health, stated: 


...there seems to be quite a clear consensus, certainly around clinical people, that this 
small data set...is a significantly useful data set in clinical terms.” 


62. Richard Granger also pointed out the value of the SCR in supporting local unscheduled 
care: 


The summary care record is going to be the first port of call for the 115.5 hours a 
week when the GP practice is shut, so I think it is quite a useful instrument to have 
regardless of whether you stay in one place or move around...” 
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63. Lord Hunt, then the Minister responsible for the NPfIT programme, stressed the 
unique value of giving patients access to their SCR record through HealthSpace. He 


commented: 


...the great advantage of HealthSpace is...there will be a whole host of information 
about health, and my own view is that it has huge potential in helping people take 
control of their own health.” 


64. However, Dr Paul Thornton, a GP, highlighted the need to protect vulnerable patients 
from being coerced into giving others access to their SCR through HealthSpace. He warned 
that: 


Vulnerable patients will find it difficult to resist pressures from “friends”, abusive 
spouses, and parents to access and divulge the contents of their SCR.” 


Progress and implementation 


The early adopter programme 


65. The first pilots of the SCR were originally planned for December 2004. However, 
delivery of the system was postponed following delays to the delivery of the National Data 
Spine.”> Consultation about what should be included in the SCR and how the system 
should be implemented also took longer than originally planned.” A Ministerial Task 
Force was established in July 2006 “to resolve the ethical and practical differences” between 
different stakeholders including Connecting for Health, NHS bodies, professional 
organisations and patient groups.” The Task Force reported in December 2006 and pilots 
of the SCR began in Spring 2007, around two years behind schedule.” Richard Granger 
acknowledged that the delivery of the SCR has been delayed by two years because of “a 
mixture of software complexity and an extended consultation period”.” 


66. The report of the Ministerial Task Force recommended that Connecting for Health 
should “make haste slowly” with the implementation of the SCR, piloting all of the 
different functions, including patient access through HealthSpace, in its early adopter sites, 
and evaluating pilots carefully. The Task Force also recommended more training for staff 
in the use of the SCR applications and a concerted attempt to improve public 
understanding of the SCR and its benefits.*° Following the Task Force report, the SCR 
system was launched in March 2007 at two PCTs in the Bolton area. The first patient 
information was uploaded in May 2007 and will be available to out-of-hours service 
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providers from August 2007.*' Connecting for Health announced in April 2007 that the 
SCR early adopter programme, would be independently evaluated by University College 
London.** 


Wider implementation of the SCR 


67. It is not clear exactly how long it will take to implement the SCR across England. 
Connecting for Health has stated that the full roll-out will take “several years” and 
separately that it will last “up to 2010”. The evaluation of the early adopter programme 
will run until April 2008 and its final report will be published in summer 2008.*4 The 
Department told us that “the subsequent national roll-out is expected to commence in 
financial year 2008/9.*° 


68. Despite the delays to the initial implementation of the SCR, officials assured the 
Committee that the amended timetable will prove reliable. Richard Granger commented 
that: 


BT have delivered every one of their central software drops on time for the past 18 
months. There was lots of delay before that, but this has become quite a reliable 
delivery environment now.*° 


69. Officials also predicted that there will be genuine enthusiasm amongst clinicians and 
patients for the SCR system to be rolled out. Dr Braunold stated: 


I have no doubt that the value of a coded record on the summary...will have GPs 
and patients crying out for the Summary Care Record faster than we can deliver it.*” 


70. Some planned features of the SCR programme are not available at present but will be 
added later in the early adopter phase. For example, we were told that electronic “sealed 
envelopes” to allow patients to restrict access to particularly sensitive information are due 
to be available from April 2008.** In addition, patients will be able to access their personal 
information on the HealthSpace website some point during the early adopter phase.* 


Consent systems 


71. One of the key areas examined during the Committee’s inquiry was the degree to which 
patients will be able to control what information is contained in their SCR and who is able 
to access it. This has proved a complex and controversial subject with considerable media 
and public debate surrounding the first trials of the SCR. Witnesses stressed that consent 
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systems are important and require careful planning and communication if trust in records 
systems is to be maintained.” 


Initial plans: an opt-out consent system 


72. In its initial submission to the Committee, in March 2007, the Department of Health 
stated that patients who did not wish to have an SCR created would be able to opt out of 
the scheme: 


Individuals who have concerns can choose not to have a Summary Care Record 
created for them. They will be advised to inform their GP of their views and to 
request that a note be made of their concerns and the choice they have made. The GP 
practice may ask the patient to sign a form indicating that they understand and 
accept that it may not be possible for the NHS to provide them with the same care as 
others...”! 


73. Harry Cayton stated that the opt-out consent approach was in keeping with the 
recommendations of the Ministerial Task Force on the SCR, of which he was the chair. He 
described it as “the most practical, ethical and appropriate way forward” and commented 
that members of the Task Force had agreed unanimously on the opt-out model.” Richard 
Granger argued with conviction that the opt-out approach would strike an appropriate 
balance between protecting patient privacy and taking advantage of the practical benefits 
offered by electronic records systems: 


...some people would like all information to be available everywhere; and then at the 
other end of the spectrum there are the privacy fascists who would like to dictate that 
nobody has any information available anywhere. We have been trying to forge a path 
between those extremities.” 


Legal objections 


74. Some witnesses, however, argued that the opt-out approach could be subject to legal 
challenges. Press for Change, the UK’s largest representative organisation for transsexual 
people, predicted that: 


The uploading of data without [explicit] patient consent would leave General 
Practitioners open to prosecution.” 


75. Douwe Korff, Professor of International Law at London Metropolitan University, told 
the Committee that the opt-out system would not be compliant with European law, 
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regardless of whether it met the requirements of the UK Data Protection Act. He 
concluded that: 


If one uploads the summary care record or the more elaborate care records without 
making that distinction one is extremely likely to break European law... I would be 
happy to take a case to the European Court of Human Rights in Strasbourg which 
has also become increasingly aware of and strict in the support of data protection 
principles.” 


76. However, the legality of the opt-out approach proposed by the Department was 
supported by evidence from the Information Commissioner’s Office, the organisation 
which regulates data privacy.” Jonathan Bamford, the Assistant Information 
Commissioner, told the Committee that: 


If patients are informed that they can exercise a proper choice over what happens to 
their information on the basis of transparency, and they have the opportunity and 
time to make that choice, it is consistent with the requirements of the Data 
Protection Act to provide it on an opt-out basis.” 


Mr Bamford also argued that the opt-out consent approach was consistent with European 
legal requirements.” 


Ethical objections: should an opt-in system be used? 


77. Other witnesses argued that the opt-out consent model was unethical and would be 
likely to reduce patient choice and empowerment. Joyce Robins of Patient Concern stated 
that: 


We were active in the Department of Health’s consent initiative four years ago. Since 
then we and many other groups have worked very hard to try to give patients the 
confidence to play an active part in their own healthcare. The care records scheme 
with its assumed consent policy drives a tank through the whole thing. We are back 
to the old paternalistic idea “We'll do what’s good for you; don’t you bother your 
confused little heads.”'° 


78. Andrew Hawker, an NHS patient, commented that even if the number of patients 
choosing to opt out of the SCR programme proved very low, their wishes should be 
respected. He regarded Connecting for Health documents describing the risks to patients 
of not having an SCR as “ominous” and “over the top”.’°’ Mr Hawker concluded that: 
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_..we have to come back to whether or not an individual patient has the right to say, 
“I do not want information handled in a particular way”, and I was very disturbed to 
hear the sort of argument that says 98% of people are going to come round, therefore 
these other troublesome people should be swept aside.'” 


79. Ethical objections to the opt-out consent model were expressed by clinical as well as 
patient groups. Amongst those advocating an opt-in or explicit consent approach were the 
British Medical Association (BMA), the Royal College of Psychiatrists and a number of 
individual GPs.'° The BMA stated that: 


...it is for patients to decide, in discussion with a healthcare professional where 
appropriate, the extent to which their clinical information is placed on electronic 
systems...The BMA’s policy is for explicit consent to be obtained before any 
healthcare information is uploaded onto the system.” 


80. Dr Paul Cundy argued that an opt-in or explicit consent approach would be a more 
effective way to build patient trust in the new system. He suggested that consent could be 
gained by GPs during routine consultations: 


When the patient next comes to see their GP you can discuss whether you want 
something going on [to the SCR], you can do it slowly over time, and in taking that 
approach, which is a default opt-in approach, you slowly build the system and that 
allows time for trust in the system to be developed.’ 


81. However, officials expressed clear objections on 26 April to the use of an opt-in consent 
system. Harry Cayton argued that an informed consent system would be impractical, 
estimating that “100 years of GP time” would be required to offer informed consent to 
every patient in the country.’” He also thought that an opt-in system would tend to 
disadvantage vulnerable groups: 


...if you have an informed consent to be part of the system, then large sections of 
society, particularly some of the most vulnerable people in society, do not take part. 
They do not take part because they do not know how to give informed consent, they 
do not take part because they do not understand what is being asked or offered and 
they do not take part because of physical immobility. ..1°’ 


Subsequent plans: a hybrid consent system 


82. In spite of these comments, the Department of Health subsequently outlined more 
detailed consent proposals for the Summary Care Record, which included the addition of a 
significant opt-in element. A supplementary memorandum, received on 12 June 2007, 
explained that: 





102 Q116 

103 See Ev 41, Ev 103, Ev 137, Ev 149 and Ev 186, respectively 
104 Ev 42 

105 Q118 

106 Ibid 

107 Q59 


The Electronic Patient Record 33 


...the assumption of implicit consent (i.e. the opt-out approach) relates only to the 
initial setting-up of the Summary Care Record and the inclusion of medication, 
allergies and adverse reactions. The next stage of adding the patient’s significant 
medical history will occur only after a discussion between the patient and their GP 
and therefore requires explicit consent (i.e. opting-in) unless there is a lawful basis 
for recording information without consent, e.g. when a patient lacks capacity.'% 


83. At the subsequent evidence session on 14 June, Dr Simon Eccles confirmed to the 
Committee that information will be placed on the SCR in at least three separate phases 
with different consent models. Dr Eccles explained that: 


The creation of the SCR and the addition of information about allergies, adverse 
drug reaction and prescriptions will take place by implied consent i.e. unless the 
patient chooses to opt out; 


More detailed information such as significant medical history, key operations and 
lifestyle information can subsequently be added but only with explicit consent 
from the patient. Patients can view this information before it is added to the SCR; 
and 


Hospital information such as discharge summaries, clinical letters and A&E 
summaries can also be added with explicit consent from the patient.’ 


84. The Department’s 12 June memorandum also provided more details about patients’ 
options for regulating access to the SCR. Three distinct consent positions were described: 


The ‘red’ position: the patient chooses not to have an SCR created; 


The ‘amber’ position: the patient chooses to have an SCR created but not accessible 
to clinicians other than their GP; the patient can subsequently choose to grant 
access to specific clinicians; 


The ‘green’ position: the patient chooses to have an SCR created and made 
accessible to any clinician caring for the patient or with another legitimate interest 
in viewing the information." 


85. It is difficult to assess views amongst clinical and patient groups about the hybrid 
consent system eventually set out by the Department because the details of the system were 
only made clear to the Committee at the end of its inquiry. It is clear from the evidence 
received that most stakeholders believed that the opt-out consent model would apply to all 
information placed on the SCR. Patients in particular expressed concern about the lack of 
clarity about both content and consent.'"’ Andrew Hawker, an NHS patient, offered an 
eloquent perspective on the situation: 
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I feel like a passenger boarding a plane. On board are technicians arguing about how 
the plane’s controls should be wired together, and who should do it. The plane has 
not had many test flights, and some of those have crashed. Meanwhile, flight 
attendants are handing out brochures saying how safe it all is."” 


86. Yet it is clear that the proposed hybrid consent system will help to address a number of 
the questions raised by witnesses by giving patients more control over their information 
and ensuring that more detailed information is only added to the SCR with explicit 
consent. Concerns that particularly sensitive information, for instance about sexual health, 
might be added to the SCR against a patient’s wishes are to some degree addressed by using 
an explicit consent model for information about medical history. There are some clear 
exceptions to this rule, particularly prescription information, which will be added to the 
SCR with implicit rather than explicit consent. As FIPR pointed out, prescription 
information will often be sufficient to allow an educated guess of possible diagnoses to be 
made, a difficulty which is not addressed by the hybrid consent model.'!” 


87. Similarly, concerns about large numbers of clinicians having potential access to the 
SCR are in part addressed by the ‘amber’ consent position which will allow patients to have 
an SCR created but not shared without their permission. Given the advantages of the 
hybrid consent system, it is perplexing that the Department has not done more to make the 
full details available to patients, clinicians and other stakeholders. 


88. Moreover, the new consent system exposes contradictions in the Department’s 
position. Officials have at times contradicted themselves and each other. The use of an 
‘opt-in’ system for the majority of SCR information, for example, ignores the arguments 
made by Harry Cayton on 26 April that such an approach will disadvantage vulnerable 
groups.’ Mr Cayton also argued at the same session that this approach was unsuitable as it 
would use up very large amounts of GP time.'> Yet Dr Simon Eccles subsequently argued 
on 14 June that the impact on GP time is likely to be minimal." 


Patient ownership 


89. During its visit to France, the Committee learnt that French patients will legally own 
their Dossier Médicale Personnel (DMP), the equivalent of the SCR. This means that 
patients can use sophisticated controls to regulate access to the DMP and clinicians cannot 
access the record unless the patient is present and agrees. French officials argued that this 
approach had helped both to make the DMP more popular with patients and to safeguard 
information privacy. The importance of patients having greater ownership of their SCR 
was stressed during our inquiry by the NHS Alliance and the Royal College of GPs.” 
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Sealed envelopes 


Description and progress 


90. Another planned feature of the consent system is the introduction of “sealed 
envelopes”, which will allow patients to restrict access to specific pieces of information 
which they consider particularly sensitive. Such systems are planned for both the SCR and 
for local DCRs. The Department explained that two different types of “sealed envelopes 
will be available to patients: 


¢ The standard “sealed envelope” which is visible to clinicians accessing the patient’s 
record but which can only be opened with specific permission from the patient; 
and 


e “Sealed and locked” envelopes which are not a visible part of the patient’s record 
and whose existence is known only to the patient and clinicians with permission to 
view the information. 


91. “Sealed envelopes” are not yet a functioning part of the SCR system and are not 
available to patients in the first early adopter sites. However, officials told the Committee 
that this functionality would be available by April or May 2008.''® This date was confirmed 
by BT, the suppliers of the SCR system.'’ However, it was not clear when DCR “sealed 
envelopes” would be available.!”° 


92. The Committee heard during its visit to Paris that controls similar to “sealed 
envelopes” (and known as “masquage” systems) will be available to protect information in 
the Dossier Médicale Personnel. French officials told us that “masquage” systems have 
already been completed. 


Questions and concerns 


93. Unsurprisingly, witnesses expressed concern that the software to create “sealed 
envelopes” has not been completed before the start of the SCR early adopter phase. 
Dr Peter Gooderham, a GP, complained that: 


... sealed envelopes” have been advanced as an important method of protecting 
patient confidentiality. However, the technology was not in existence at the time the 
Department of Health described them... This appears highly unsatisfactory.'”! 


Professor Douwe Korff commented that: 


I would not buy a car if the engineer told me he was still working on the brakes but 
by the time I was a few miles away he would probably have sorted it out.'” 
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94. Questions were also raised about how effective “sealed envelopes” would be at 
protecting confidentiality. The Assistant Information Commissioner told the Committee 
that his organisation was concerned about whether sealed information could be accessed in 
an emergency and whether patients would be able to see audit trails showing who had 
accessed this information.’” 


95. However, officials defended the efficacy of the planned systems. Dr Gillian Braunold 
told the Committee that “sealed envelope” systems had been demonstrated to a conference 
of sexual health clinicians, a group which she described as “the most challenging...of all 
that exist” and “the most sceptical” about plans for protecting sensitive information. 
Dr Braunold explained that exactly half of this group expressed positive support for the 
NCRS in light of planned consent arrangements.’ 


96. Other witnesses expressed concern that information in “sealed envelopes” would be 
made available for research and other purposes via the Secondary Uses Service. Professor 
Douwe Korff argued that particularly sensitive information should not be accessible in this 
way, even following anonymisation or pseudonymisation, as this would breach European 
law.'?? The Department of Health subsequently clarified that while “sealed” information 
will be available to the Secondary Uses Service, “sealed and locked” information will not.!”° 
We consider these issues further in Chapter 5. 


Security systems 


97. Witnesses also expressed concerns about whether SCR data, and other information 
held on the National Data Spine, could be held securely. These concerns fell into two broad 
categories which we consider below: 


e One set of concerns related to the technical security of the national systems, for 
example the likelihood of the system being infiltrated by hackers and the possibility 
of data theft from the SCR; and 


e Separate concerns were raised about operational security, also referred to as 
the “human factor”; such concerns focussed on how access to the SCR would 
be controlled and monitored, particularly across an organisation as large, 
complex and federated as the NHS. 


Technical security 


98. The SCR is one element of the National Data Spine supplied by BT. Access to the SCR 
is via the New National Network for the NHS (N3), also supplied by BT.'” The Committee 
does not have sufficient technical knowledge to make specific judgements on the external 
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security of these systems and the likelihood of illegal infiltration, nor did we seek detailed, 
technical evidence about security systems. However, the Committee did seek the general 
views of officials, suppliers and academic experts about the likely effectiveness of security 
systems. 


Planned security measures 


99. Officials acknowledged that no system of information storage can be considered 
entirely secure and stated that “different vulnerabilities” affect paper and electronic storage 
systems.'** Richard Granger pointed out that security risks are being mitigated by the use 
of experienced suppliers who also work for the security services, by introducing 
functionality incrementally with thorough evaluation, and by ensuring compliance with 
HL7 international infrastructure standards.’ Mr Granger also argued that the significant 
benefits of sharing information electronically outweigh the small but unavoidable risk of a 
security breach.’ In a subsequent submission, the Department described the system’s 
technical security apparatus in more detail: 


The new systems will be protected by state of the art security measures capable of 
providing far greater protection than has ever been the case previously. The NHS 
patient database (the Spine) will reside within a fully private network known as N3. 
The Spine system and database can be accessed only from within this private 
network. Should an attacker somehow gain access to the NHS private network they 
would then have to break through three separate layers of tiered architecture—each 
tier being protected by twin firewalls (of different manufacture) to access the 
database. The firewalls are supported by intrusion detection systems and other 
multiple security measures, which monitor network traffic routinely and raise an 
alert on the detection of suspicious activity.’” 


100. BT, the supplier of the national systems, offered strong assurances about technical 
security levels, arguing that unlawful access to the National Data Spine would be “near 
impossible” without the assistance of a registered user, ie. without a breach of operational 
security.!? Patrick O’Connell, Managing Director of BT Health, told the Committee that 
BT has an ongoing programme of internal testing to ensure that systems cannot be 
infiltrated." BT also stressed the inevitability of a trade-off between the level of system 
security and the practicalities of making systems user-friendly, particularly to busy 
clinicians: 


...the specification of the system we are delivering achieves an important balance 
between value for money, operational effectiveness and ease of use, likely threat of 
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infiltration and potential for damage through infiltration. Spine has not yet been 
penetrated.'* 


Challenges and criticisms 


101. Some witnesses, however, raised doubts about planned technical security systems. 
Brian Randell, Professor of Computing Science at Newcastle University, told the 
Committee that suppliers had not provided information about likely security levels to 
Connecting for Health: 


When I and colleagues met Mr Granger a year ago we were absolutely shocked to 
find that Connecting for Health did not have any documents stating things like the 
reliability and security guarantees. They said that they did not have them because 
they were regarded as confidential to the suppliers. I still find that absolutely gob- 
smacking.’ 


102. In its 16 July memorandum, however, the Department stated that: 


Professor Randell was not told that NHS Connecting for Health did not have 
reliability and security documentation. He was told that this existed but that, for 
reasons of confidential and commercially sensitive content, they could not be 
disclosed to third parties...'*° 


103. More worryingly, doubts were raised about the overall architecture of the electronic 
records systems and the decision to create a National Spine for storing and transferring 
information. Witnesses argued that the creation of a nationally accessible system, rather 
than a series of smaller, local systems, would increase the risk of security breaches. The UK 
Computing Research Council stated that: 


...a single system accessible by all NHS employees from all trusts maximises rather 
than minimises the risk of a security breach. It increases the number of patients 
affected by the worst case breach...In short, it provides both a bigger target and a 
larger number of points of attack than a series of smaller systems.'*” 


104. The British Computer Society took this point further, arguing that higher levels of 
security would be achieved by storing information in a “distributed database” rather than 
on centralised storage systems. Such a system would allow clinicians to search a range of 
local databases for information about a particular patient which could be drawn together 
into a “virtual” record when required, rather than being permanently stored in one place.'* 
But officials were dismissive of this idea. Richard Granger pointed out that: 


We did not want to, frankly, experiment with the very, very large distributed 
network. None of the leading suppliers of solutions in this space who are willing to 
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bid and take financial and completion risk around the delivery came up with that 
architecture...!% 


Operational security 


105. Many witnesses stated that ensuring the operational security of the new electronic 
patient record systems is likely to represent a still stiffer challenge than maintaining 
technical security. This argument was applied particularly to the SCR system, which can in 
theory give access to clinical information about any NHS patient from any point in the 
country. The Medical Protection Society commented that security problems are most likely 
to be caused by “the human factor which is not subject to system controls”.'*° BT pointed 
out that the “nature of the environment” in the NHS would make ensuring operational 
security difficult, for example because NHS buildings are freely accessible to the public and 
IT security is unlikely to be closely monitored in busy hospital departments.'*! The 
challenge was summarised by Symantec: 


...technology alone cannot be relied upon when developing and implementing 
electronic patient records. Education and training of NHS staff, at all levels, on the 
importance of data management will also be required." 


Planned security measures 


106. Evidence from officials and suppliers described a range of measures which will be used 
to maximise the operational security of the SCR system. Many of these measures will also 
be used to protect local DCR systems and some are discussed further in Chapter 4. The 
measures set out include: 


¢ Access to the SCR system requires users to insert a valid smartcard as well as 
entering a user name and password; 


¢ Receipt of a smartcard follows a registration process which requires users to 
present identification and to be sponsored by a senior member of their 
organisation (this process ensures that security complies with level 3 of the e- 
Government Interoperability Framework);'* 


¢ Users accessing the SCR system will only be able to view information relevant to 
their job role, so an administrator will not typically be able to view clinical 
information. This safeguard is known as role-based access control; 


¢ Users can only access information about a patient after specifying a legitimate 
relationship with the patient, for example a clinician providing treatment or a 
receptionist recording the patient’s arrival in clinic; 
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e AQ full audit trail will be maintained by the SCR system, indicating who has 
accessed patient information and for what purpose. This information can be 
viewed by GPs and Caldicott Guardians and will be available to patients on 


request;'“ and 


e Attempts are being made to improve the enforcement of operational security 
systems by increasing the penalty for attempting to access information unlawfully. 
Support for stronger penalties has been expressed by the Information 
Commissioner’s Office, the Department of Health and the General Medical 
Council.'* 


107. BT also described some technical features of the SCR system which aim to improve 
operational security, including automatic logouts if systems are left unused and 
programmes for detecting unusual or malicious accessing of SCR data."*° 


Challenges and criticisms 


108. A number of doubts were raised about plans for maintaining the operational security 
of the SCR system. Professor Brian Randell was sceptical about how effective role-based 
limitations on access would prove: 


If one has role-based access control with a very large number of complicated roles in 
a situation where there is a lot of changing roles it will be extremely difficult to deal 
with all the individual decisions that are being made as to who should have what role 
and what privileges...1 am deeply suspicious of the practical efficacy of such a 
system.'*7 


109. A number of witnesses raised concerns about the use of smartcards to access 
electronic records systems, and particularly about whether access would be fast enough." 
However, such concerns did not relate specifically to the SCR system and so we consider 
them further in Chapter 4. 


110. Regarding audit trails, Professor Brian Randell argued that monitoring access to the 
SCR was a good idea in principle but that the sheer volume of records created would make 
effective oversight difficult: 
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If...one has a system where it turns out that there are huge numbers of audit records 
being generated to the point where nobody is looking at them, that is a...system that 
is not being properly designed." 


111. Dr Martyn Thomas argued that security systems did not appear to have been designed 
with users in mind, meaning that people would inevitably “work around” security 
procedures. He stated that: 


..-in deciding what the specification for the technology should be, you actually need 
to start by looking at the specification for the overall social system and deriving the 
specification for the technology out of the way that people are genuinely going to 
behave when faced with the technology... The moment it appears to them that the 
systems are getting in the way of them doing their job, which they see as treating 
patients and running the hospital effectively, they start working around the 
systems.'*° 


112. But suppliers disagreed, arguing that every effort had been made to ensure that 
security systems did not interfere unnecessarily with existing working practices. Guy Hains 
of CSC stated that suppliers were “super-sensitive” to the need to design systems which 
were both secure and practical to use.!>! 


Conclusions and recommendations 


113. The Committee is pleased that trials of the national Summary Care Record (SCR) 
are now going ahead following delays to the project. The SCR has the potential to 
improve the safety and efficiency of care and to make the health service more patient- 
centred. The SCR has the potential to improve the safety and efficiency of care 
especially in emergency situations when care is delivered by staff unfamiliar with the 
patient involved. The Committee supports the aim of introducing a nationally available 
summary record as soon as possible and deplores the delays and continuing indecision 
about its content. 


114. The SCR has less comprehensive clinical value than shared Detailed Care Record 
(DCR) systems and is a comparatively straightforward application which extracts 
information from existing GP systems, whereas DCR systems must be built up from a 
range of complex and interdependent component applications. Given that there is 
expected to be clinical value from the SCR, its roll-out should not be held back by delays 
to DCR systems. We examine DCR systems in more detail in Chapter 4. 


115. The Committee was dismayed, however, by the lack of clarity about what 
information will be included in the SCR and what the record will be used for. Officials 
gave different answers to these questions on different occasions. The Committee was 
told at various times that the SCR will be used for the delivery of unscheduled care, for 
the care of patients with long-term conditions, and to exchange information between 
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primary and secondary care. It is little wonder that patient groups expressed confusion 
about the purpose and content of the SCR. 


116. The Committee is aware of the Department’s most recent plans but is concerned 
that the complexity of the SCR appears to be increasing. This will make the SCR more 
difficult to use, particularly in emergency situations. The Department must be clear 
about the purpose of the SCR, and it must ensure that the record is easy to use. To this 
end, we recommend that the SCR include a single standardised front screen to display 
key health information which is vital for emergency care. 


117. The Committee has also received inconsistent information about the patient 
consent arrangements for the SCR. Initially, we were told that information will be 
added to the SCR with “implied consent”, provided patients do not opt out. This 
approach was strongly criticised by clinical and patient groups. However, it 
subsequently became clear that while the creation of the SCR, and the addition of “life- 
saving” details such as prescription information, will require “implied consent”, the 
addition of detailed clinical information will only take place with “explicit consent” 
from the patient. This hybrid consent system represents a much more satisfactory 
model but one which has not been well communicated to patients or clinicians. 


118. The inclusion of prescription information on the SCR with only “implied consent” 
remains problematic, however. On the one hand, prescription information can often 
make a patient’s diagnosis obvious. On the other hand, excluding some prescription 
information from the SCR would be clinically dangerous. If the Department of Health 
does use the “implicit consent” model for prescription information, it should make 
clear to patients the implications both for data privacy and clinical safety. 


119. The Committee considers that much of the controversy over privacy and consent 
arrangements for the SCR would have been avoided if Connecting for Health had 
communicated its plans more clearly to patients. We recommend that Connecting for 
Health: 


e Make clear to patients, clinicians and the public that detailed information 
will only be added to the SCR with explicit patient consent, that patients 
can see this information before it is added, and that patients can choose to 
have an SCR created but not accessed beyond their GP surgery; and 


¢ Offer the same assurances to all patients in the SCR early adopter sites. 


120. The arrangements for the SCR will be strengthened when “sealed envelopes” are 
made available to protect sensitive information and when patients can access their 
record via the HealthSpace website. It is unfortunate that these elements of the SCR are 
not yet in place, but the Committee understands and supports the decision to press 
ahead in any case with trials of the SCR. Connecting for Health must ensure that both 
“sealed envelopes” and HealthSpace are introduced as soon as possible, particularly so 
that their effectiveness can be assessed during the independent evaluation of the early 
adopter programme. 


121. “Sealed envelopes” are a vital mechanism if sensitive information is to be held on 
the SCR. We recommend that: 
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¢ The right to break the seal protecting information in “sealed envelopes” should 
only be held by patients themselves, except where there is a legal requirement to 
override this measure; and 


¢ Information in “sealed envelopes” should not be made available to the 
Secondary Uses Service under any circumstances; this will allow patients to 
prevent data being used for research purposes without their consent. 


122. HealthSpace is an excellent addition to the SCR programme and has huge 
potential to improve the safety and efficiency of care by allowing patients to check the 
accuracy of their SCR and to access detailed information about their own health. In 
order to take fuller advantage of HealthSpace, we recommend that Connecting for 
Health: 


¢ Trial the use of HealthSpace for patients, particularly those with long-term 
conditions, to record their own measurements of key health information; 


e Ensure that HealthSpace allows patients to view audit trails, showing who has 
accessed their SCR record and under what circumstances, and offers 
mechanisms for investigating inappropriate access; 


e Promote the use of HealthSpace, monitor levels of uptake, and ensure that there 
is equitable access across the country and that coercive access is prevented; and 


¢ Commission an independent evaluation of HealthSpace once the system is 
widely available. 


123. We note that in France patients will own their national summary record. This 
approach gives patients more control over who can access their record and more 
opportunity to influence and take control of their own care. We therefore recommend 
that Connecting for Health consider a similar model for the SCR in England. 


124. The Committee does not have the knowledge or expertise to make specific 
judgements about the likely effectiveness of planned technical security systems at 
protecting the SCR from external attack. We received strong assurances from officials 
and suppliers about the quality of security systems, and we accept the inevitability of a 
trade-off between levels of security and the need to ensure that systems are user- 
friendly. We also acknowledge that no information storage system can be considered 
100% secure. 


125. However, serious concerns were expressed regarding the lack of information both 
about how security systems will work and about the outcomes of security testing. We 
agree with these concerns and recommend that Connecting for Health ensure that BT’s 
planned security systems for its national applications are subject to independent 
evaluation and that the outcomes of this are made public. 


126. Maintaining the operational security of the new SCR system is a substantial 
challenge. We acknowledge that Connecting for Health and its suppliers have made 
significant efforts to minimise the risk of operational security breaches. Individual 
smartcards, rigorous user authentication, role-based access controls, legitimate 
relationships and audit trails will all help to increase operational security, both 
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individually and in combination. However, many of these measures are new and 
untested on the scale that they will be used in the NHS. As a result, their impact and 
vulnerabilities are difficult to predict. We therefore recommend that Connecting for 


Health: 


e Ensure that the evaluation of the early adopter sites examines both the 
individual and the collective impact of the new operational security measures 
for the SCR, commissioning a separate evaluation if necessary; and 


e Undertake a program of operational security training for all staff with access to 
the SCR, emphasising the importance of not divulging information to those 
who request it under false pretexts. 


127. Operational security also depends on effective enforcement. The Department of 
Health and the Information Commissioner’s Office have called for custodial sentences 
for people who unlawfully access personal information. The Committee welcomes this, 
and recommends that a substantial audit resource be provided to detect and prosecute 
those who access the system unlawfully. 
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4 Detailed Care Records 





128. As well as the national Summary Care Record, the NHS Care Records Service aims to 
create more detailed patient records at local level and the capacity to share rich clinical 
information between local organisations. In this chapter we examine the development of 
local Detailed Care Records (DCRs) and the systems which will support them. We look 
particularly at: 


¢ The different visions of how local electronic records systems will work, including 
significant areas of uncertainty, as well as the substantial benefits of introducing 
shared local systems; 


e Progress to date on the delivery of the various components of local electronic 
record systems and the timetable for the completion of shared DCR systems; 


e Arguments about the way forward on the development of DCR systems; and 


e Issues relating to the safety and reliability of DCR systems and the model for 
patient consent. 


Vision and potential benefits 


129. The creation of DCR systems represents a large and complex set of projects and 
accounts for the bulk of expenditure on the NCRS.'** One official described DCR systems 
as the “Holy Grail” of the national programme.'*’ In this section we look at how DCR 
systems will work and their great potential to improve patient care. We focus in particular 
on: 


e The overall vision for shared DCR systems; 
e The benefits offered by DCR systems; 


e The various component systems which will contribute to the shared record and the 
infrastructure developments required to support the DCR; and 


¢ Outstanding areas of uncertainty about exactly what will be provided. 


Overall vision 


130. NPfIT’s original vision for creating shared local records systems was set out in its 
specification document for the “Integrated Care Records Service”, published in 2003. The 
document described the need for “integrated clinical information systems across the whole 
care continuum” and envisaged that “the patient will pass seamlessly through the system 
with...information flowing with the patient”. Integrated local record systems were 
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described as “the foundation and bed-rock for integrated care”.’* Integrated records 
systems would support “care pathways”, examples of which included a routine GP visit, a 
hospital referral to fit a pacemaker, and the A&E admission of a diabetic suffering a 
hypoglycaemic attack.!® Electronic systems to support these “care pathways” were to be 
delivered in basic form by December 2006 and in full by 2010."”° 


131. However, the Department’s descriptions during our inquiry of local record systems, 
now referred to as “Detailed Care Records” (DCRs), bore little resemblance to this 
blueprint, and did not make reference to the 2003 specifications.’"’ Nor was it clear 
whether DCRs are still intended to support the integrated “care pathways” set out in 2003. 
There was a stark contrast between the specific and detailed vision set out for the 
“Integrated Care Records Service” in 2003, and the vague and shifting vision set out for the 
DCR in 2007. 


132. During out inquiry, the Department did provide general, high-level descriptions of 
how DCR systems will work. We were told that the broad aim of the DCR project was to 
standardise the information collected from a range of local records systems, including 
hospital and GP records and imaging databases, and from these create an integrated 
record. Hospitals, GP surgeries and other provider organisations would continue to have 
local records systems, and not all the information held locally would be available on the 
DCR. However, local systems would need to be able to communicate with each other and 
to exchange data to create the integrated DCR. The exact information contained in the 
DCR, and the size of the area covered by each DCR network, would be likely to vary across 
the country, and would also depend on the specific clinical requirements for managing the 
patient.'°* 


133. The Department’s 12 June 2007 memorandum described existing local storage 
systems where patient information is generally kept on a range of different records which 
often overlap and are very rarely linked together. A single patient may have: 


e A GP record, “usually held electronically but often supplemented by paper 
records’; 


e An electronic hospital record with administrative and demographic details at each 
hospital the patient has visited; 


e Separate paper records containing clinical information at each hospital visited; 


e Further separate records for maternity care, mental health care, sexual health care, 
and for each separate A&E attendance;!° and 


e Records of care received in the community, for example for long-term conditions. 
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134. The Department described the ultimate goal of the DCR project as to bring 
information from these separate records systems together to create a shared electronic 
record accessible across the local area. The Department stated that: 


The Programme [NPfIT] has a clear objective to reduce this duplication of diverse 
records by providing a patient centred electronic Detailed Care Record that spans 
these areas. As a minimum, this would be within a hospital but there are real benefits 
when providing a consistent record across a local health community and across the 
boundaries involved in care pathways for a patient.! 


135. Other witnesses described the potential of the DCR project to enable communication 
between distinct organisations, as well as providing shared records. Fundamental to this 
communication is the ability of separate IT systems to exchange information, a concept 
known as “interoperability”. Dr Paul Cundy highlighted the importance of ensuring that 
systems are compatible: 


You want the electronic island of hospital to be able to communicate a meaningful 
message about a patient to the electronic island that is relevant (e.g. the general 
practice)...and that is precisely what interoperability is about and I believe that is 
precisely what you are seeing the programme now moving towards.'*! 


136. DCR systems can also change the way that care is delivered by supporting clinical 
processes and decision-making, and allowing activities such as prescribing to be done 
electronically. Frank Burns described more sophisticated DCR systems as “patient care 
management systems” rather than merely patient records systems.’ Alan Shackman, an 
IT consultant, commented on the great potential for changing clinical processes by 
introducing DCR systems. He stated that: 


The summary care record is basically an information repository...but a detailed care 
record is much more than that... The key thing is that the detailed care record more 
than a database allows clinicians and others to do things. It allows them to prescribe 
drugs, to order tests. It allows care plans to be devolved. It allows quite complicated 
things to be done...'® 


Benefits from Detailed Care Record systems 


The Department’s view 


137. Witnesses consistently emphasised the benefits of providing shared local electronic 
records. The Department of Health’s March 2007 memorandum set out a range of 
advantages, including: 
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e Increasing efficiency by ensuring that relevant information can be shared more 
quickly and the same information is not collected and recorded on multiple 
occasions; 


e Underpinning the provision of integrated care between different organisations, 
between primary and secondary care, and even between different parts of the same 
organisation. This will offer particular benefits for the growing number of patients 
with long-term conditions;'™ and 


¢ Reducing medical errors, by providing more accurate and timely clinical 
information and, for example, through the provision of electronic prescribing 
services.'® 


Other views 


138. Other witnesses agreed that DCR systems have great potential to increase the 
integration of care, and particularly to improve care for patients with chronic and long- 
term conditions.’© The Renal Association stated that: 


...the great majority of health gain from NHS CRS will be in local health 
communities. The largest early gains will be in the care of people with chronic 
disease.'®” 


139. Frank Burns argued that the greatest benefits will derive from sophisticated clinical 
systems which not only record and share information but also automate clinical processes 
such as prescribing. He stated that: 


...these systems actually support practising clinicians in their day-to-day work 
providing better care for patients; and where clinical management systems have been 
installed...there is very serious evidence of the capacity of these systems to improve 
patient care... The real priority for the NHS...in my view, and I think it is a view that 
is supported by most clinicians, is for detailed care records at a local level.’* 


140. Others agreed that the benefits gained from implementing local DCR systems were 
significantly greater than those from the national SCR system. The Association of the 
British Pharmaceutical Industry wrote that: 


...increasing patient safety through the active monitoring of safety and efficacy of 
new and existing medicines...cannot be achieved without access to the detailed 
electronic patient record. This will not be provided by Connecting for Health in the 
proposed centrally-held Summary Care Record.'® 
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141. Most witnesses confirmed that DCR systems would offer a substantial range of 
significant benefits. The very strong case for their introduction was summarised by Frank 
Burns: 


Having to make the case for [local] electronic records is on a par with having to 
make the case for the telephone, the television, central heating and the motor car.'” 


Infrastructure and components for the Detailed Care Record 


142. Achieving the ultimate vision for the DCR, and the many benefits which it offers, 
relies on the success of a large number of complex projects. These include upgrades both to 
the infrastructure supporting IT across the NHS and to large numbers of local IT systems 
in hospital, community facilities and GP surgeries. In order to achieve the level of system 
interoperability necessary to support effective DCR systems, Connecting for Health has set 
out to replace significant elements of existing NHS IT systems. 


A national foundation 


143. A fundamental part of the infrastructure for the proposed DCR systems is the New 
National Network for the NHS (N3), provided by BT under a national contract. N3 
connects all NHS organisations in a private network and will be the vehicle for all sharing 
of information between separate IT systems. The secure communication necessary for 
DCR systems to share information safely and efficiently relies heavily on N3.!7! 


Local building blocks 


144. Responsibility for implementing DCR systems falls largely to the Local Service 
Providers (LSPs) operating within each of the five regional “clusters”. LSPs are responsible 
both for the upgrading of large numbers of local IT systems, and for ensuring the 
interoperability between systems required to support the DCR. The main projects being 
undertaken by LSPs are set out below: 


a) The replacement of hospital Patient Administration System (PAS) software is a vital 
step in creating DCRs. All hospitals will receive new PASs which have the capacity to 
communicate both with national NPfIT systems, such as the Spine, and with other local 
systems, for example GP systems. All patient data on existing PAS systems will be 
transferred to the new systems. Two different PAS products are being installed. In the 
London and Southern clusters, the Millennium system (supplied by the US company 
Cerner) will be provided.'” In the remaining 3 clusters, a new product called Lorenzo 
(developed by iSoft, a UK firm) is to be introduced.'” As well as replacing 
administrative functions, the new PAS applications will offer some clinical functions: it 
is intended, for example, to use the Millennium system to support electronic 
prescribing. 
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b) The introduction of new PAS systems for community and mental health providers, 
the majority of which previously relied on paper systems, is another key step. Again, 
new community PAS systems will be interoperable with national and local systems. In 
the London cluster, the RiO system (supplied by CSE Servelec) will be provided for 
community and mental health care organisations.'” In the remaining four clusters, the 
community PAS system will be the same product as the hospital PAS system. 


c) The replacement or upgrade of some GP practice IT systems was also planned, in 
particular to ensure that all practices had software which is interoperable with national 
and local NPfIT systems. Connecting for Health has now decided instead to allow each 
practice to choose a new or upgraded system from a range of different packages 
accredited by NPfIT. In order to be accredited, such systems much be fully 
interoperable with other NPfIT systems. This initiative is known as GP Systems of 
Choice.” 


d) LSPs will also install Picture Archiving and Communications Systems (PACS) in all 
hospitals. PACS systems allow X-rays and other images to be captured, stored and 
shared electronically and will be one of the components of shared DCR systems.'”° 


e) Local systems will be further enhanced through the provision of more sophisticated 
clinical systems, particularly in hospitals. Such systems are intended to build where 
necessary on the functionality provided by new PAS systems, offering more detailed 
patient record storage as well as more automation of clinical processes. Such systems 
are typically specific to individual hospital departments, such as cardiology, or to 
specific patient groups, such as renal patients.'”” We discuss such systems in more detail 
in the box below. 


145. Connecting for Health has chosen to create the DCR by replacing or upgrading a wide 
range of stand-alone IT systems and ensuring that all such systems are interoperable both 
with each other and with the national NPfIT infrastructure.'” The collation of information 
from these systems to form a shared care record is the ultimate goal of the DCR project. 


What do we mean by “sophisticated clinical systems”? 


In hospitals, a clinical information system is typically a computerised medical record 
that provides the usual functions of the patient’s paper record. It enables the recording 


of clinical data generated at times of patient-professional interaction and the 
presentation of such data at subsequent contacts. Clinical data include problems, 
symptoms, signs, diagnoses, severity scales, patient expectations, plans, medication, 
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interventions and outcomes. 


More sophisticated clinical information systems also support clinical actions such as 
test ordering, scheduling of investigations and procedures, prescribing and 
communication. Details may be recorded at contacts (such as ward rounds. 
consultations or telephone calls), or to document clinical interventions (such as 
counselling, physiotherapy, angiography, or surgery). Some information will be 
recorded in structured, coded form, and some as free text. 


To date, clinical information systems have typically been designed to focus on the care 
of patients with defined diagnoses (e.g. diabetes), or to support specific interventions 
(such as prescribing, operations, endoscopy) or the work of individual departments 
(e.g. cardiology or urology). However, such systems do not create a comprehensive 
record for patients with chronic disease or multiple problems, particularly when such 
patients are seen by many different clinicians. To meet this requirement, still more | 
sophisticated systems are needed, which focus on the individual patient irrespective of 
the context in which they are seen, and record and support all their problems and care 
in a single longitudinal record. 





A common language 


146. Sharing information between different organisations and care settings will require 
more standardisation and coding of data. This is vital if complex clinical information is to 
be exchanged accurately and efficiently between a range of practitioners. Efforts to increase 
the standardisation of clinical information have been co-ordinated by Connecting for 
Health and include: 


¢ Agreement on the introduction of the Systemised Nomenclature of Medicine, also 
known as SNOMED CT, across the NHS.'” SNOMED CT is a single 
comprehensive database of codes covering diseases, operations, treatments, drugs 
and a number of other areas. It is described by Connecting for Health as “the 
language of the NHS Care Records Service”; 

* The development of an NHS Data Dictionary so that the meaning of different 
clinical and administrative terms in the context of the NHS is understood 


consistently;'*' and 


¢ Attempts to increase the use of the NHS number as a unique identifier for patient 
information. This is vital to developing integrated records as it allows patient 
episodes which take place in different hospitals, or different departments of the 
same hospital, to be linked together.'** Connecting for Health introduced the NHS 
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Numbers For Babies scheme, which allocates a lifetime NHS number at birth, in 
2002.'** 


We discuss the requirements for standardising information to support DCR systems in 
more detail below. 


Areas of uncertainty 


Appearance and content of the DCR 


147. In spite of the obvious scale and ambition of the DCR project, the Committee received 
uncertain and sometimes conflicting evidence about what Connecting for Health and its 
suppliers will actually deliver. Most fundamentally, it was not clear what the shared DCR 
will be able to do and exactly what information it will contain. 


148. Officials offered some information on this point. Dr Gillian Braunold explained that 
the DCR will enable information sharing between primary and secondary care, replacing 
slower paper-based communication.'* Dr Simon Eccles commented on the importance of 
ensuring that the new systems installed in GP practices, hospitals and community care 
organisations are interoperable.'* But officials did not supply precise details about the 
appearance or specification of shared DCR systems. 


149. Explanations from suppliers were similarly opaque. Patrick O’Connell of BT, the LSP 
for London, described the DCR as “a single view so that a patient’s record can be viewed in 
a variety of care pathways”. Guy Hains of CSC, LSP for three of the five regional clusters, 
stated that: 


The Detailed Care Record is variously at the GP and a secondary care setting like a 
hospital where your treatment record will be held.1*° 


150. Professor Naomi Fulop of King’s College London, whose research has examined the 
delivery of NPfIT systems in the acute sector, succinctly captured concerns about the lack 
of detailed information on the DCR: 


What I would add about the detailed record is that it has not been communicated to 
people what it is.'*” 
Depth of information sharing 


151. In light of this problem, witnesses inevitably raised other questions about the specific 
plans for DCR systems. Dr Paul Thornton, a GP, questioned the level of detail of 
information sharing that DCR systems would offer, concluding that: 
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Detailed Care Records...can never provide the level of detailed data sharing which 
would be necessary for shared care.!** 


152. Suppliers provided little reassurance, commenting that the degree to which local 
organisations store and share information electronically will in part be for them to decide. 
Guy Hains of CSC stated that: 


University Hospital Birmingham has an advanced view; it wants to move to a very 
high level of electronically-stored records. Other hospitals may choose also to have a 
reference to paper-held records. We are not mandating the level of efficiency and 
automation to which those hospitals take their full records.'*° 


153. Neither suppliers nor officials made clear whether organisations would be subject to 
specific requirements for sharing information through DCR systems. Witnesses argued 
that it is therefore difficult to assess the level of detail which DCR systems will provide and 
to judge the clinical value of the planned records.'”” 


Breadth of information sharing 


154. A related set of concerns focussed on the range of organisations and the geographical 
area which will be covered by each DCR. Professor Naomi Fulop and Dr Paul Thornton 
both highlighted fears that organisations which are geographically adjacent may be unable 
to share information, because they form part either of different health economies or of 
different NPfIT clusters. Such barriers, they argued, would inevitably reduce the value of 
the shared DCR.”? 


155. Suppliers stated that the scope of information sharing would be decided locally. 
Guy Hains compared plans for two different areas: 


...one would be Morecambe Bay Acute Trust where there are 2,500 users effectively 
on one system compared with Greater Manchester... They have a system for Greater 
Manchester with about 13,500 users on it.'”” 


156. The Department of Health told us that there is likely to be significant variation 
regarding the breadth of the area across which DCR systems will be shared. The 
Department’s 12 June 2007 memorandum stated that: 


_..in future, records can be shared amongst a locally determined health community 
that is on the same IT system. Typically, as a minimum, this is at GP practice level or 
hospital level but can span Strategic Health Authorities (SHAs) or other local health 
communities as agreed between the NHS and suppliers.’”° 
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Sophistication of new systems 


157. Some witnesses also questioned whether the new administrative and clinical systems 
due to be supplied as components of the DCR would represent significant improvements 
on existing systems. The Renal Association, for example, commented that: 


Many renal centres have well-developed decision support systems that should not be 
lost by the introduction of generic less flexible systems. It is unclear whether the 
proposed Lorenzo solution will be able to offer the same level of sophistication on 
which we have come to rely.” 


158. Frank Burns argued that the upgrading of hospital PAS software would not represent 
a significant advance in itself, as such systems have been in used in hospitals “for the last 20 
years”.!° He pointed out that significant advances will not be possible until more complex 
clinical systems are installed, a development for which there is no clear timetable.’ 
Mr Burns also commented that: 


Many in the NHS believe that by the time the systems procured are 
implemented...what they end up with will not be the sophisticated clinical 
management systems that they need for modern healthcare.!%” 


We provide more detail on what is meant by “sophisticated” clinical systems in the box 
above. 
Progress and implementation 


159. Although many questions were raised about precisely what DCR systems comprise, 
these were significantly outnumbered by concerns about when such systems would be 
delivered. In this section, therefore, we look at the progress to date on implementing the 
various components of local record systems and the shared DCR itself. We look 
particularly at: 


e Progress in developing each of the specific systems and components which will 
make up the DCR; 


e The timetable for the completion of the shared DCR itself: 


e Reasons for delays to elements of the DCR project and to the provision of shared 
local records; 


e Progress on the delivery of new hospital PAS software; and 


e Progress on developing coding systems, a unique identifier and clinical 
information standards to enable data sharing. 





194 Ev 90 
195 Q515 
196 Ibid 

197 Ev 144 


The Electronic Patient Record 55 


Progress on specific systems 


160. Progress to date on each of the main systems which will contribute to the shared DCR 
is set out below: 


a) 


b) 


c) 


d) 


e) 


The N3 Network and National Data Spine, which provide the backbone for all sharing 
of information between systems, are both operating successfully. Officials told us that 
more than 19,000 N3 connections have been installed across the NHS and that the 
system had been completed two months ahead of schedule.!* Functions are being 
added to the National Spine incrementally following earlier delays of around ten 
months to software delivery.’ With regard to the N3 network, Richard Granger stated 
that “we have one of the biggest virtual private networks on the planet and people take 
that for granted.” 


By contrast, the delivery of hospital PAS systems has been significantly delayed. The 
Department acknowledged that implementation is “up to two years behind the original 
schedule”.”” Because of the importance and complexity of this element of the DCR 
project, we examine it in specific detail below. 


The delivery of community and mental health PAS software has apparently been 
more successful than that of hospital systems. Officials told us that 105 systems have 
been deployed in total.*” Patrick O’Connell stated that BT has made 18 deployments of 
the RiO systems to community providers in London.’ CSC stated that 60 community 
PAS deployments have been made across its three clusters.”* But Alan Shackman 
argued that the community software deployed by CSC represented an interim solution 
that will have to be replaced once again when the Lorenzo product becomes available.” 


Connecting for Health procured a catalogue of accredited GP systems in February 
2007 under the GP Systems of Choice initiative, which we discuss further below. 
Connecting for Health has also put in place a system for transferring records between 
GP practices, known as GP2GP.*° 


Picture Archiving and Communication Systems (PACS) have been successfully 
implemented in three-quarters of hospitals, according to the Royal College of 
Radiologists.” Several witnesses argued that, because of the maturity of PACS 
technology and the enthusiasm for implementing these systems, such success would 
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have been achieved irrespective of NPfIT.2% However, the Department disagreed, 
pointing out that the speed with which PACS applications have been delivered has 
increased dramatically as a result of the national programme.” 


f) The delivery of Electronic Transfer of Prescription (ETP), also known as electronic 
prescribing systems, has been less successful, particularly in hospitals. Officials told us 
that while use of ETP systems is growing in GP and community settings, use in the 
acute sector is limited to a “handful” of hospitals.” Richard Granger told the 
Committee that hospital ETP systems will be introduced “over the next two to three 
years”.”"! In Delivering 21“ Century IT, published in 2002, the Department set a target 
for 100% coverage of ETP systems in the NHS by the end of 2007.7” 


g) The delivery of other more detailed clinical systems has been very limited, largely 
because of the delays in implementing basic hospital PAS applications. Although such 
systems are not a prerequisite of shared DCR systems, more clinically rich systems will 
add significant value to the DCR.” The Lorenzo and Millennium systems are likely to 
offer some clinical functions, but Connecting for Health also put out a tender earlier 
this year for a range of other clinical systems. We discuss this in more detail below. 


h) Due to the delays to a number of constituent projects, progress on the delivery of 
shared Detailed Care Records has hardly begun, as we set out below. 


Delivery of the Detailed Care Record itself 


Officials’ views 


161. The Department did not provide an exact timetable for achieving the ultimate goal of 
the DCR project, the delivery of the shared record itself. Its initial submission in March 
2007 stated that: 


The transformation from paper to digital information will take place gradually up to 
2010 and beyond.”* 


162. The subsequent memorandum, received in June 2007, argued that specific completion 
dates could not be given because of the wide range of systems being delivered across 
different parts of the country and different tiers of care. The Department also pointed out 
that DCR systems will be built up incrementally and as such do not necessarily have a fixed 
implementation or completion date. The Department concluded that: 
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..-Itis not a single monolithic system due for delivery or go-live at one point in time. 
The Programme comprises a range of new and existing systems, introduced 
incrementally and meeting the Programme’s objectives over time...LSPs’ plans are 
all based on delivering incremental improvements.2!5 


163. Officials also challenged the view that the delivery of DCR systems as a whole is 
behind schedule, arguing that each element of the new systems should be considered 
separately. Richard Granger stated that: 


It is inaccurate to state that the whole of the programme is late. That is not true. 
Some of the programme is late, some of it is on time and some of it is early...7"° 


Suppliers’ views 


164. BT, the LSP for the London cluster, provided a clear timetable for the completion of 
DCR systems within this area. In its written evidence, the company stated: 


The foundations of the NPfIT system provided by BT are now built, operating and 
secure. Culturally integrating these systems so they become second nature for NHS 
staff is well underway. Over the next five years, the goal is to complete this 
programme.”” 


165. In oral evidence, Patrick O’Connell set out a still shorter timetable for the completion 
of DCR systems in London: 


...this year and next year [i.e. 2007 and 2008] we are rolling out the basic stand-alone 
capability...once it is established that we have the capability then we intend to link it 
together...In a stand-alone capability we should finish in 2009 and complete and 
integrated in about 2010.”"* 


Thus, according to Mr O’Connell, all London hospitals, community providers and GP 
surgeries will have had their basic systems upgraded by 2009 and integration of systems to 
create the DCR system will take place in 2010. However, as discussed above, the exact 
content of the DCR, and the degree of information sharing that will initially be possible, 
were not made clear. 


166. CSC, the LSP for three of the five NPfIT clusters, did not provide such a precise 
timetable for the introduction of DCR systems. Guy Hains told the Committee that the 
Lorenzo system, intended to be the main PAS software for hospitals and community 
providers, would be implemented for the first time “in the middle of next year”, suggesting 
an overall timetable some way behind that of BT.” Fujitsu, the LSP for the Southern 
cluster, did not provide evidence to the Committee. 
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Other views 


167. Other witnesses were more sceptical about when DCR systems would be delivered. 
The British Association for Community Child Health described detailed shared records as 
“a mirage with an ever receding completion date”. Alan Shackman pointed out the 
continuing delays to the introduction of hospital PAS applications have meant that more 
sophisticated clinical systems cannot be deployed. He concluded: 


...there remains no definitive timescale for introducing the clinically focused 
software that would take functionality in any significant way beyond the basic PAS 
functionality that was available to the NHS when NPfIT began in 2002.” 


168. Frank Burns also commented that more “clinically rich” systems, from which the 
greatest benefits will be derived, have proved the “slowest in coming forward”.”” Mr Burns 
gave the specific example of acute trust electronic prescribing systems, one of the original 
objectives of the NPfIT project and an important component of DCR systems. He stated 
that: 


As far as the hospital side is concerned, electronic prescribing is the very last in the 
list of things that are going to be delivered by NPfIT, and there are people who fear 
they will never ever be delivered.” 


169. In short, witnesses argued that even if some form of shared DCR systems were 
delivered in the next few years, more clinically rich systems will take much longer to 
provide.”* In this context, the current lack of clarity about content and levels of 
information sharing within DCR systems is worrying, especially when compared with the 
2003 specification documents which provided a lot of specific detail about the project’s 
original goals.”° Dr Martyn Thomas expressed grave concern about the loss of clarity 
about what the project will deliver and changes to the “milestones” for demonstrating step- 
by-step progress on the development of the DCR. He argued: 


What typically happens is that people start redefining what the milestones meant, in 
order to claim success for milestones and to put off the day when they have to admit 
that things have gone wrong, and they start arguing about what it was they really 
were setting out to do at the beginning, so they start getting a bit weasely about what 
the specification really was. ..7° 
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General causes of delay 


170. It is clear that some elements of DCR systems, such as the N3 network and hospital 
PACS, have been delivered on time. Yet others, such as hospital PAS and ETP systems, 
have fallen significantly behind schedule, leading to overall delays in the delivery of shared 
records themselves. A very wide range of reasons was suggested for the delays to these 
elements of the project, as we set out below. 


Officials’ views 
171. Officials offered several explanations for the delays to DCR systems: 


a) Significant expansion to the scope of the project had been a cause of delays. This 
included the addition of a number of projects, for example PACS, QMAS and GP2GP 
transfer, to the overall scope of NPfIT. Richard Granger acknowledged that the 
addition of new systems had set back the implementation of DCR systems, but argued 
that “in the real world it would be ridiculous to imagine that halfway through a ten-year 
programme you would only be doing the same things as you set out five years ago”.””” 


b) This problem was compounded by the fixed budget for the project. Officials argued 
that development problems could not be resolved by spending extra money, for 
example on temporary staff, and that some time delays were therefore inevitable when 
difficulties were encountered. Mr Granger told us that “the only expression of dealing 
with problems on this programme is necessarily time, because we are operating within 
a financial cap and the functionality demands have tended to increase rather than 
decrease”.””* 


c) The implementation of new systems, particularly where this involved a replacement of 
existing systems, proved more difficult that envisaged.” We discuss this with 
particular reference to new hospital PAS deployments below. 


Suppliers views 


172. Suppliers offered somewhat different, though not conflicting, explanations for delays. 
Patrick O’Connell of BT argued that NPfIT “is following a profile that is somewhat typical 
of very large national transformation programmes”. He went on to state: 


I have been managing these things for about 24 years now...Typically, they do have a 
slow start but with the right spirit and the right expertise on both sides they get 
around the corner and they start to perform...I think you will see us picking up 
speed as we go along.” 
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173. CSC argued that the sheer scale and complexity of the programme had led to delays. 
The company stated that “the deployment of technology across an organisation as complex 


and far 


reaching as the NHS” represented a unique undertaking, making it difficult to 


provide accurate timetables for completion. CSC also described the original timetables for 


the programme as “ambitious”. 


Other 


22 


views 


174. Other witnesses offered a wide range of explanations for delays to DCR projects. The 
most commonly suggested were: 


Unrealistic and overambitious timescales for delivering new systems.” Stalis, a 
UK technology firm, stated that “project goals must be realistic and those for 
NPfIT in general and the Care Records Service in particular were not”. 

A lack of clear specifications for what the programme would deliver. Dr Martyn 
Thomas argued that without such specifications “any schedule that you put 
together...is built on sand”.** 


A failure to appreciate the need for changes to processes and working practices to 
accompany the installation of new systems. Witnesses argued that this had meant 
organisations were often unprepared to receive new systems or unwilling to 
volunteer for implementations.” 


The excessively centralised approach adopted by the programme, not only to 
procurement but also to the delivery of new systems. Witnesses argued that this 
approach had stifled local activity, for example on implementing hospital PAS 
software, and left individual organisations frustrated and disengaged.”” Professor 
John Feehally of the Renal Association commented that: “if at the beginning of this 
sorry process they had simply given local health networks some resource and said, 
‘You will just simply resolve the question of the primary care computer system 
talking to the hospital computer system’, we would all now be smiling”.”* 


A lack of clinical and user engagement in the development of new systems which 
has made it difficult to stimulate progress and activity at a local level.”? The BMA 
argued that increased clinical engagement “could have highlighted potential 
problems at an earlier stage” and thereby reduced overall delays.” 
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Upgrading hospital Patient Administration § ystem software 


175. The delays to the delivery of new hospital PAS software were highlighted as a 
particular cause for concern. These delays have had the knock-on effect of delaying the 
deployment of more sophisticated clinical systems in secondary care. Such systems are a 
core element of the DCR: shared records cannot be achieved without properly functional 
and integrated electronic hospital records. 


Progress and timetables 


176. Progress on implementing new PAS systems has varied across the different regional 
clusters, as we detail below. 


a) 


b) 


c) 
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BT plans to install Cerner’s Millennium PAS software at hospitals across London. 
Patrick O'Connell told the Committee on 7 June that BT planned to complete all local 
deployments by 2009 but that only one deployment has taken place to date, at Queen 
Mary's hospital in Sidcup.’ The Millennium system has also been deployed at 
Homerton and Newham hospitals as part of a local procurement with no connection to 
NPfIT. BT had originally planned to use IDX as its hospital PAS supplier but switched 
to Cerner’s Millennium system in July 2006. 


Cerner’s Millennium system will also be deployed by Fujitsu at hospitals in the 
Southern cluster. Like BT, Fujitsu had planned to use IDX as its supplier but switched 
to Cerner in June 2005. Fujitsu and BT had worked together on a “Common Solution 
Project” for installing hospital systems across their clusters, but this partnership was 
also dissolved in 2005.” Alan Shackman stated in March 2007 that the Millennium 
system had been deployed at five acute trusts in the Southern cluster. He commented 
that after “a false start”, progress on deployments was “encouraging”.”° 


In the North East, Eastern and North West & West Midlands clusters, CSC plans to 
deploy iSoft’s Lorenzo software in all hospitals. Unlike Cerner’s Millennium system, 
which is already widely used in the US, Lorenzo is a new-build application.** There 
have been no deployments of Lorenzo to date and none are planned until mid-2008, 
according to CSC.** Richard Granger told us that Lorenzo would be trialled in 
Germany in June 2007 but confirmed that no deployments in England would take place 
until 2008.%° Guy Hains commented that CSC was putting “an awful lot of support” 
into developing the product.¥” CSC has made 11 deployments of a more limited PAS 
application, iPM, at hospitals in the North West & West Midlands cluster.“* However, 
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Alan Shackman described iPM as a system “with no clinical functionality” which could 
not contribute to a shared DCR system.” 


Reasons for delays to hospital PAS implementation 


177. Differing explanations were given for the delays to the two main hospital PAS 
applications, Millennium and Lorenzo. Although some deployments of Cerner’s 
Millennium system have now taken place, implementation is still behind schedule. 
Richard Granger commented that one cause of the delays had been difficulties in 
“anglicising” Millennium, which is primarily used in the US, so that it could operate in the 
NHS. Patrick O’Connell commented that switching software suppliers from IDX to 
Cerner had delayed hospital PAS deployments in London.” Mr O’Connell also cited the 
breakdown of the “Common Solution Project” between Fujitsu and BT as a cause of 
delays.” 


178. Regarding the Lorenzo system, Richard Granger stated the sheer complexity of 
building a new software system from scratch had delayed the project.”’ Guy Hains of CSC 
commented that the need for rigorous testing and the decision to make Lorenzo an 
internationally available product had both contributed to delays.** Mr Hains also 
acknowledged that takeover speculation regarding iSoft, the company developing Lorenzo, 
had added to the problem, commenting that “uncertainty regarding iSoft and its future 
ownership has proved an unwelcome distraction”.*°° 


179. Richard Granger also pointed out that the process of actually deploying new hospital 
PAS software had proved more difficult than expected, particularly because of the need to 
move data from old systems onto new ones without causing excessive disruption to the 
delivery of care. He stated that: 


Brownfield site implementations are incredibly difficult...You might have half a 
million records. ..that have to be cleaned up by staff in the hospital... It is a big heavy- 
lifting systems engineering job. It is like replacing the core systems in a small 
government department or small corporation...in a weekend.” 


Impact of delays 


180. Hospital PAS applications are a fundamental element of DCR systems and delays to 
their deployment have been a primary cause of difficulties in making progress on the 
provision of shared records systems. Witnesses also pointed out other problems caused by 
delays in upgrading hospital systems, including: 
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¢ A possible impact on patient safety in hospitals with particularly old computer 
systems, because of reliability problems and difficulties in maintaining out-of-date 
software.” One witness described a trust buying new parts for its PAS from eBay 
because they were no longer available elsewhere;?°* and 


¢ Frustration and disengagement at local level because of continuing delays, and 
particularly because the delays to new PASs prevent more clinically rich systems 
from being deployed.?” 


Coding and information standards 


181. So that information can be accurately shared and combined between the different 
parts of the DCR system, data will increasingly need to be recorded in a standard way. The 
Department of Health described the need for “a much more structured approach” to 
record keeping, stating that: 


...clinicians will need to adopt the new approach to record keeping. This will need a 
cultural change in the practices of health professionals which should not and could 
not be led by an IT programme but must be seen as a significant improvement to 
patient care and therefore owned and led by the NHS.” 


The NHS number 


182. Witnesses highlighted the importance of the unique identifier, the NHS number, in 
increasing the standardisation and quality of a patient’s record. Professor Carol Dezateux 
of the Institute of Child Health described the 2002 introduction of NHS Numbers for 
Babies, which allocates a lifetime NHS number at birth, as “an outstanding success”.”*! But 
Dr Mark Walport of the Wellcome Trust pointed out that the NHS number is not yet 
regularly used for all patients whenever they come into contact with the NHS.” Professor 
Dezateux argued that the NHS number should be used whenever a patient interacts with 
the health service. She commented: 


There is not a mandated system for doing that but it is not technically challenging or 
difficult to do, given the right leadership and the right go-ahead.” 


183. The difficulties caused when a unique identifier is not used were outlined by Dr Gill 
Markham of the Royal College of Radiologists. She described the inconsistent use of the 
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NHS number as a “huge difficulty”, giving the example of problems with the sharing of 
diagnostic images.” She commented that: 


...largely because of this [inconsistent use of the] unique identifier, you cannot 
transfer images; and there is an enormous industry at the moment with people 
burning CDs, putting the images onto CDs that then get sent to the hospital that 
might be two miles down the road...” 


184. Dr Markham and Professor Dezateux both pointed out that consistent use of the NHS 
number has been achieved in Scotland, which has a separate numbering system. They 
argued that this should be a key priority for the NHS in England and that effective use of a 
unique identifier would significantly improve the quality of clinical information, benefiting 
both direct patient care and clinical research.” In its 16 July memorandum, the 
Department of Health told us that plans are in place to achieve more comprehensive usage 
of the NHS number, but did not set a specific timetable for achieving this: 


Work underway currently with the authority of the National Programme Board is 
aiming to ensure that the NHS number is mandated by the Information Standards 
Board and subsequently adopted incrementally for use within IT systems across the 
NHS within a reasonable period.” 


185. Dr Markham also highlighted the need to allocate temporary NHS numbers rapidly, 
for use for example when patients are admitted unconscious for emergency treatment, but 
added that these temporary numbers should be subsequently reconciled with the unique 
permanent NHS number.’*® 


Coding systems 


186. As mentioned above, significant progress on introducing a single coding vocabulary 
into the NHS has already been achieved. Connecting for Health has been active in the 
development of SNOMED CT, an internationally recognised coding system for recording 
clinical data including symptoms, diagnoses, treatments, drugs and a range of other 
information.” SNOMED CT will be used to code data in both SCR and DCR systems. The 
importance of using a common coding system across the NHS was highlighted by Dr Paul 
Cundy. He explained that: 


Exchanging or sharing data between systems that have disparate coding 
arrangements creates unnecessary complexity and introduces dangers. It is accepted 
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that all systems in the NHS should use a common coding system and one has been 
identified; SNOMED.?” 


Clinical information standards 


187. However, witnesses argued that there was also a need for a more holistic approach to 
standardising information for use in DCR systems. The Royal College of Physicians (RCP) 
pointed out that alongside a universal coding system there is a need for agreed datasets and 
approaches to structuring information. Such “information standards” will allow 
information to be shared meaningfully between clinicians, reduce the potential for errors, 
and make it easier to use data for health research. The RCP argued that significant work 
was required to agree information standards for different clinical specialties (e.g. 
cardiology and gastroenterology), different disease areas (e.g. diabetes and epilepsy) and 
different care settings (e.g. outpatients, admissions and GP consultations).””’ Coding, in 
short, offers a common vocabulary, but exchanging detailed clinical information also 
requires an agreed syntax, which is likely to vary between different clinical specialties and 
patient groups.” 


188. Unfortunately, there was little evidence of progress in this important area. The RCP 
stated that: 


The definition of this detail and the structure of the record to record it should be 
agreed nationally, based on work undertaken by appropriate professional bodies 
such as the Royal Colleges and Specialist Societies. To date the Colleges have not 
been requested to undertake this work...””° 


189. When questioned about plans for this work, officials argued that Connecting for 
Health has had regular contact with Royal Colleges and other specialist societies.” Lord 
Hunt also told us that a new forum would be established at national level between 
Connecting for Health and the Academy of Medical Royal Colleges.” But officials did not 
explain the purpose of such engagement and did not set out plans or progress on 
developing the necessary professionally-agreed information standards.” 


Changing working practices 


190. Central agreement on new ways of coding, structuring and recording clinical 
information is of little value if such systems are not used at a local level. Officials 


nnn EEEnEE nna nT aE Un nnnnEnI NEE SEER 


270 Ev 130 (HC 422-III) 


271 See Ev 100-101 


272 The RCP gave the example of work to develop a standard approach to collecting and recording information about 
acute medical admissions. It commented (Ev 101) that “The Royal College of Physicians has developed both generic 
medical record-keeping standards and standards for the structure and content of the acute medical admission.” 


= 


273 See Ev 101, the RCP pointed out that it has pioneered work on information standards for the acute medical 
admission, but this had not been done in conjunction with Connecting for Health. 


274 Q610 


275 Q 580 


276 By contrast, the Committee heard on its visit to Canada that developing detailed clinical information standards had 
been one of the earliest priorities for Canada Health Infoway, the organisation responsible for developing EPR 


systems. 


66 The Electronic Patient Record 


commented that the implementation of clinical coding systems at the front line was likely 
to prove challenging, especially in secondary care. Richard Granger stated that: 


It is going to be a long and difficult process to get the complexities of secondary care 
to code information in a way that it can be used outside of the location in which it 
was originally created.” 


191.Mr Granger also commented that difficulties had been encountered when 
implementing Cerner’s Millennium system at hospitals in the Southern cluster because of 
the need to code more information at the point of care.’”’ But officials did not say how they 
planned to address such problems on a wider scale. Nor was it made clear what support 
will be given to hospitals and other organisations to change working practices. 
Alan Shackman underlined the lack of focus on changing clinical processes: 


...the change management, changing the process...was going to be covered by the 
Modernisation Agency, which no longer is with us, so I struggle a bit to find any 
concerted way of helping make the process change happen whereas of course there is 
a most concerted way of actually getting the technology in.*” 


The way forward 


192. It is clear that some elements of the DCR programme, such as the creation of the N3 
network and the roll-out of hospital PACS systems, are set to be successfully achieved. 
However, it is equally evident that other parts of the project are beset by significant 
problems. The most serious of these are: 


e The lack of clarity about the ultimate vision for the shared DCR record, particularly 
the area which will be covered and the level of information which will be shared; 


e The absence ofa clear timetable for implementing shared DCR records; and 


e Ongoing delays to the delivery of new hospital PAS software, a key prerequisite for 
implementing both shared record systems and more sophisticated local hospital 
EPR systems. The failure to deploy the Lorenzo system anywhere in the NHS is a 
particular concern. 


193. Witnesses made a range of suggestions for addressing these complex challenges and 
for ensuring that the delivery of DCR systems is achieved as quickly and effectively as 
possible. The most common proposals, which we discuss below, were: 


¢ An independent technical review of the programme, examining plans, progress 
and requirements for successful delivery; and 


¢ A concerted effort to increase local ownership of the programme, in particular by 
devolving responsibility for the delivery of DCR systems. 
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An independent technical review? 


194. Amongst those witnesses to call for an independent technical review of the 
programme were the UK Computing Research Council and Computer Weekly 
magazine,”° but the clearest explanation of the case for a review came in a submission from 
a group of 23 “senior academics in computing and systems”.”*! The 23 academics drew on 
a “Dossier of Concerns” submitted to the Committee in 2006, which detailed a litany of 
problems with the programme.” These concerns, totalling 35 in all, ranged from poor 
planning, an over-centralised approach and unrealistic timescales and budgets, through to 
“inappropriate aggression and machismo” and “fear of failure”.? The submission 
concluded that: 


...our analysis illustrates very dramatically the number, variety and complexity of the 
concerns surrounding NPfIT, and thus provides a compelling argument for 
commissioning a detailed review of the project, carried out by evidently-independent 
experts with full access to all relevant information and personnel.”*4 


195. The case for an independent review was put to the Committee in more detail by 
Professors Martyn Thomas and Brian Randell, both members of the group of 23 
academics. Professor Randell pointed out that public IT programmes have benefited from 
such reviews in the past and stressed that the review should look at operational as well as 
technical aspects of the programme.” Professor Thomas gave the example of the new 
Swanwick air traffic control system, which he argued had benefited significantly from an 
external review.”* He also argued that a review by external experts would be able to resolve 
issues which the programme’s leaders might be unaware of or unwilling to acknowledge: 


...my experience of carrying out those reviews is that people get blinded by the fact 
that they are too close to the project and they get compromised by the fact that they 
cannot stand back and admit errors.” 


196. Officials and suppliers both denied the need for an independent, external review. 
Richard Granger argued that the programme had already been heavily scrutinised, for 
example by the National Audit Office, and that Ministers had therefore concluded that a 
further review was not necessary.”** Guy Hains pointed out that suppliers were subject to 
regular reviews, both technical and commercial, and stated that elements of the 
programme were in effect reviewed every two months.” Guy Hains and Patrick O’Connell 
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both pointed out that individual systems were subject to high levels of audit and testing.” 
Mr Granger was particularly dismissive of the “Dossier of Concerns” prepared by the 23 
academics: 


If there are people who want to work from an evidence base, the door has always 
been open for them to come and work with us, but people who just lob cold 
collations of negative media coverage in so-called dossiers hardly do themselves a 
service as a serious group of people that are working from a robust evidence base.” 


197. Andrew Hawker suggested that rather than undertaking a full-scale review, elements 
of the programme should be subject to more independent testing with published 
outcomes.”” Professor Thomas argued that if this approach were chosen then such testing 
should focus not only on the technical security of new systems, but also on how DCR 
systems would actually be used once implemented. He stated that: 


...my instinct would be to do lots of prototyping and work with the clinicians in the 
frontline to really find out what works for them, what they are happy with, what 
works with their patients, and then to stand back and decide what you want to do on 
a national basis...””? 


Increasing local ownership 


198. Some of the strongest criticism of the approach adopted by NPfIT to developing DCR 
systems argued that procurement and implementation have been too centralised, stifling 
local ownership and innovation.” The need to maintain a balance between central and 
local input into the programme was acknowledged by officials. Richard Granger 
commented: 


...you come back to this paradox of the necessity of strong local leadership and 
management ownership...with a necessity of buying things at a higher level in the 
NHS in order to make them affordable. So we have to do both; it is not an 
either/or...there has to be a balance struck between standardisation and 
localisation...?”° 


The need for central input 


199. Officials strongly defended the value of the central direction and leadership which 
have characterised the programme to date, highlighting in particular that: 


¢ Centrally procured and managed contracts have helped to ensure that widespread 
upgrades to local systems are affordable. Richard Granger argued that where EPR 
systems have been purchased locally, these have not proved affordable in the long 
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term.” He commented that “it is not about all the money being spent nationally. 
It is about the unit cost being too high if things are bought locally”.”” 


The national approach is necessary to ensure the consistent development of new 
systems across the country, rather than the previous “islands of excellence”.”°’ Lord 
Hunt argued that: “the national approach that we have taken was absolutely 
essential in terms of ring-fencing the resource, giving it the priority and ensuring 
that the NHS did move in step.”?” 


Central input has a particular role in ensuring interoperability between newly 
procured systems, a fundamental part of establishing shared DCR systems. Richard 
Granger argued: “if we would like to indulge ourselves with 200 rich local systems 
across the NHS we not only cannot afford them, we will forever be locked into 
information not being moveable between locations. ..”3 


The need for local input 


200. Officials and other witnesses also pointed out the clear advantages of involving local 
organisations, particularly in the development of the systems which will make up the 
shared DCR record. The following arguments in particular were put forward: 


The involvement of local users, particularly clinicians, is vital if implementation of 
new systems is to be successful. Lord Hunt pointed out: “it has got to make sense 
for senior management to engage the clinicians because if you have an institution 
where the clinicians have not been involved the one thing you can be sure is that 
when the PAS system is introduced it is not going to work very well”.*” 


Ensuring interoperability between systems is best done at a local level and would 
have been treated as a higher priority if the programme had not been centrally 
managed. In particular, PCTs should have been given responsibility for ensuring 
interoperability between local systems.*” 


PCTs are responsible for commissioning healthcare in general and should 
therefore be made accountable for implementing the DCR, as shared record 
systems are fundamental to the delivery of care. Frank Burns made the case for 
more PCT involvement with the programme, arguing that “there needs to be some 


local accountability for ensuring that patients have reliable records”.**” 
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Shifting the balance of power: steps to date 


201. There is some recent evidence of changes to the approach to delivering DCR systems 
in light of the case for increased local input. There are three main examples: 


a) 


b) 


c) 


The NPfIT Local Ownership Programme (NLOP), which was implemented following 
a review of the management of NPfIT in October 2006. NLOP devolves responsibility 
for implementing local systems, and for some elements of the management of LSP 
contracts, from Connecting for Health to the 10 regional SHAs.** SHAs were made 
formally accountable for “implementation and the realisation of benefits” from the 
programme from 1 April 2007.°° Lord Hunt stated that implementing NPfIT has been 
made one of the four key priorities for SHAs.*% Richard Granger commented that 
senior staff at SHA level have already become closely involved in the running of the 
programme and “dealing day-to-day with key contractual management issues in 


collaboration with Connecting for Health people and frontline staff from trusts”.*” 


GP Systems of Choice (GPSoC), which will allow GP practices to choose their software 
supplier for new or upgraded practice systems to support the DCR. Suppliers will be 
approved by Connecting for Health, and will be required to meet interoperability 
standards, but individual practices can then choose from a number of accredited 
software systems.*°® GPSoC was launched in March 2006 and procurement of approved 
suppliers began in February 2007.°” 


The procurement of a range of additional systems through a tendering process begun 
by Connecting for Health in March 2007. This procurement is separate from the main 
LSP contracts and covers a wide variety of clinical and administrative systems with the 
potential to support the delivery and increase the sophistication of local DCR 
systems.*!° Additional systems procured in this way must be interoperable with all 
other NPfIT systems. 


202. Witnesses were generally supportive of these efforts. Professor Naomi Fulop argued 
that NLOP might help to address the problem of users feeling “at the bottom of the food 
chain”, but asserted that it must be “more than a token gesture”.*"’ Patrick O’Connell 
commented that NLOP would help to speed up deployments in London, although he did 
not explain how.*’” Dr Paul Cundy expressed support for providing a choice of suppliers 
for GPs, although he pointed out that this was actually a requirement of the 2003 GMS 
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contract.*'* Dr Jon Orrell, a GP, commented that GpSoC had “brought the programme 
back from the brink of disaster”.>"4 


Shifting the balance of power: future prospects 


203. The programme’s leaders clearly acknowledged the need for a balance between central 
and local input into the development of DCR systems.*!> It is likewise clear that recent 
initiatives such as NLOP and GPSoC have increased local accountability and introduced 
choice for some users. Yet many witnesses argued that the balance is still not right, and that 
more needs to be done to increase local ownership of the programme.’ This argument 
seems particularly compelling given that many of the national elements of the programme 
have been completed, while local deployments are the main challenge for the future. 


204. In this context witnesses made several suggestions for further increasing the local 
ownership of the programme: 


a) Frank Burns proposed that all local organisations should be given a choice of new 
systems, rather than having to wait for the delivery of products, such as Lorenzo, which 
have been badly delayed. Mr Burns argued that as long as interoperability between 
systems can be assured, it does not matter which specific system is installed in each 
organisation. However, he acknowledged that existing LSP contracts might make it 
difficult to increase choice in the short term.*!” Richard Granger did state that if further 
delays occurred to the delivery of Lorenzo then the Millennium system would be made 
available to hospitals in the three CSC clusters.*”* 


b) Other witnesses suggested that Connecting for Health should set central standards for 
new systems which could then be purchased through a local procurement process. 
Dr Martyn Thomas stated that central standards for interoperability would be crucial 
to ensuring that records could be shared, but that central accreditation of new systems 
need not prevent procurement and implementation from taking place locally.” Frank 
Burns recommended developing a national “catalogue” of approved systems for local 
organisations to choose from, similar to the approach adopted for GPSoC. 


c) Frank Burns argued that the NPfIT Local Ownership Programme, which devolves 
responsibility for delivery to SHAs, did not go far enough. He argued that 
accountability should be further devolved to PCTs if increased local ownership was 
to be achieved.*”” 
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Security, reliability and consent 


205. Although the ultimate goal of implementing shared DCR systems is some way from 
completion, a number of local component systems have been successfully deployed. As a 
result, the Committee was able to examine some of the operational challenges raised by 
DCR systems. In particular, we heard evidence on: 


e Plans for safeguarding the external security of shared record systems; 


» The importance of ensuring that DCR systems and the networks which support 
them have high levels of reliability, especially as dependence on IT systems for 
clinical purposes increases; 


e The challenge of maintaining operational security as the number of people with 
access to patient records increases. A particular issue was the use of smartcards to 
access DCR systems; and 


e The appropriate model for patient consent for the creation and sharing of local 
records. 


Technical security 


Security targets 


206. Questions were raised about the external security of DCR systems, particularly in light 
of the intention to share detailed and often sensitive health information between 
organisations. Dr Martyn Thomas was critical of the apparent lack of targets for protecting 
security, arguing that this would make it difficult to hold suppliers to account: 


...if you do not know how tolerable it is for a security breach to occur, you do not 
know how much effort you need to put into building systems that are adequately 
secure to meet your targets...°”" 


207. But suppliers told us that no specific security targets existed simply because no 
breaches of security were acceptable. Guy Hains of CSC explained that, 


Both parties understand that no system is foolproof, but in terms of any weaknesses 
that we find in our system, or is found through audit, we are contracted to remedy it 
quickly. Any issue where we do not remedy will be a failure by us as a contractor...it 
is a zero tolerance environment.*” 


208. Mr Hains also argued that suppliers have clear general security standards to meet, 
with regard both to protecting systems from outside attack and to the encryption of data 
being transferred between DCR systems.*” He also pointed out that LSPs undertake 
“ethical hacking” to test their security systems, commenting: 
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We are trying to break our own systems and we use the brightest and best...on a 
global basis.*”4 


System architecture 


209. The Committee also heard that technical security will be more difficult to maintain 
because of the centralised architecture of the data storage and transfer systems designed by 
LSPs. According to witnesses, regional data storage centres and the use of the national 
network to share information will make even “local” DCR systems substantial targets for 
attack.*° The perceived problem was summarised by the Foundation for Information 
Policy Research: 


It is a principle of security engineering that we can build system with functionality, 
scale or security—or indeed with any two of these attributes, but not all three. Secure 
and highly functional systems have to be local, or compartmented.*”° 


210. But officials and suppliers argued that the architecture of DCR systems would indeed 
be compartmented. Richard Granger commented that the planned architecture for data 
storage and transfer had been “incorrectly” presented as “monolithic” by commentators. 
Guy Hains of CSC agreed that building more local or more compartmented systems made 
maintaining security easier, but argued that this is precisely the aim for LSPs in designing 
DCR systems: 


...it is not one large monolithic system...it is absolutely the case that more modular, 
simpler and smaller systems are more easily protected and upgraded in future. That 
is exactly the approach we have taken. There is emphasis on keeping tight controls 
and boundaries and...firm levels of control over message-passing and encryption, 
making sure that the connectivity that we create is safe. That is the essence of the 
design.*”” 


System reliability 


211. Related concerns were raised about maintaining the reliability of DCR systems and 
preventing systems from crashing or data from being lost. The scale of the potential 
dangers posed by reliability problems was highlighted by a power failure at a CSC data 
storage centre in Maidstone in July 2006. 72 PCTs and 8 hospitals lost access to their 
administrative records systems for several days when back-up systems also failed.** 


212. Some witnesses argued that failures of this type would be increasingly likely as the 
complex and interconnected systems which make up the DCR are developed and joined 
together.°”? Professor Brian Randell told the Committee that: 
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My specialist friend...has done a lot of work on estimating failures. As a guesstimate, 
not estimate, he said that NPFIT would be likely to fail about once every four days.** 


213. But the Department of Health strongly defended the likely reliability of DCR systems, 
arguing that Professor Randell’s comment was “not supported by any evidence”.**! 
Officials also pointed out that the failure at the Maidstone centre had been an isolated 
incident and that general system reliability was adequate. Richard Granger told us that CSC 
had been fined £3 million as a result of the Maidstone incident and that the company had 
since “doubled the amount of resilience” within their data storage system.*** He described 
such difficulties as “growing pains” and dismissed predictions of wider reliability problems 
as “scaremongering”.** He also praised the reliability of the N3 network and the data 
transfer system which will support local DCRs: 


BT run both the network and the core national messaging systems and there is a very 
strong body of evidence from the published service availability data for both those 
pieces of national infrastructure that not only do they work but they have the level of 
reliability and dependability which is appropriate to the task. 


214. Guy Hains told us that CSC had learnt lessons from the Maidstone incident and had 
increased the resilience of its systems as a result. He stated that the maximum time limit for 
resolving system failures had been reduced to 24 hours, with shorter limits for key clinical 
areas. He also pointed out the importance of developing “contingency and manual 
procedures” to ensure that clinical services could be maintained in the event of system 
failure.** Finally, Mr Hains stressed that no data had been permanently lost as a result of 
the Maidstone power failure.**° 


Smartcards 


215. Many of the planned operational security measures for DCR systems are the same as 
those described for the SCR in Chapter 3. Likewise, many of the debates about the likely 
impact of systems such as role-based access controls described in Chapter 3 apply to the 
DCR as well as the SCR. Rather than repeat these arguments, we focus in this section on an 
operational security measure with particular significance for the DCR: smartcard access. 


216. The debate about the use of smartcards was ignited when an acute trust in 
Warwickshire authorised staff in its A&E department to share smartcards when accessing 
the trust’s newly installed PAS application.*”” This was in clear breach of the principle of a 
unique smartcard for each user. Officials told us that the decision to allow sharing, 
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authorised by the board of the trust, had now been reversed.*** Connecting for Health also 
stated that no breach of confidentiality had occurred as a result of the incident.3*° 


217. The Assistant Information Commissioner acknowledged that local security breaches 
of this type had occurred and stated clearly that the sharing of smartcards represented an 
unacceptable breach of operational security systems: 


...there have been some graphic examples where perhaps security precautions have 
been circumvented by people logging on for a whole shift, using one card rather than 
their own cards. That must be stamped out; there cannot be any of that.*”° 


218. But other witnesses argued that the misuse of smartcards would prove inevitable 
unless they could provide immediate access to systems. Dr Paul Cundy commented that 
unless “instantaneous” access to DCR systems could be achieved, smartcards would 
inevitably be seen as an “obstacle” to clinical processes, particularly in a busy, 
multidisciplinary environment such as A&E.*' It is notable that the justification given for 
sharing smartcards by the acute trust board in Warwickshire was that access to the new 
PAS application could take between 60 and 90 seconds.*”” 


219. CSC, the LSP for the West Midlands area, acknowledged that smartcard sharing had 
resulted from slow access times. Guy Hains commented: 


The sharing of smart cards was really about the fact that the system did not provide a 
sufficiently immediate log on for people who wanted to use the system quickly...we 
recognise the need for a smart card log on procedure of 10 seconds.” 


220. Richard Granger told us that Connecting for Health had considered using “slicker” 
systems than smartcards for accessing DCR systems. He explained that facial pattern 
recognition, retinal recognition or fingerprint recognition systems had all been examined. 
However, Mr Granger concluded that facial pattern and retinal recognition had been 
rejected because the underpinning technology remained “immature”, while fingerprint 
recognition was impractical in a clinical environment where many staff wear gloves.*4 


Consent systems 


221. The majority of the evidence we received on patient consent related to the SCR rather 
than the DCR and we discuss this in Chapter 3. Witnesses argued that the prospect of a 
nationally available SCR tended to raise more concerns about privacy than that of locally 
shared DCRs. Frank Burns commented: 
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I think that the only reason you have been having the [consent] debate is because 
they have gone for a national model with the summary care record. If they pursue a 
local approach to development of a detailed care record...you would be able to 
explain to people why their own GP needs to share information with a specialist at 
the hospital...and in that context I think the public would be much less concerned. 


Shared records 


222. In spite of this, a number of witnesses did highlight the need for robust local consent 
procedures, particularly for the sharing of information between the separate systems which 
make up the DCR. The Royal College of GPs argued for “organisational boundaries around 
information” so that data could not be shared between organisations without the patient’s 
explicit consent.*“° This suggestion, similar to the ‘amber’ consent position for the SCR, was 
also put forward by that BMA and the British Computer Society.” 


223. The Department stated that patients would be able to limit access to their detailed 
records in this way: 


...people can choose to have their information held electronically but not accessible 
to anyone outside the organisation that created it—thereby recreating an electronic 
version of the status quo. 


Local records 


224. This would mean that patients could in effect opt out of having a shared DCR. 
However, the Department pointed out that as the local systems which make up the DCR 
are introduced, an increasing amount of information, particularly from hospitals, will be 
stored electronically on LSP servers.*” Thus it will often not be possible to prevent patient- 
identifiable information from being placed on LSP records systems. The Department stated 
that: 


Individuals may ask those who are providing care for them whether or not it is 
possible to withhold information from the new IT systems but in many cases this will 
be impracticable. Some forms of care, X-rays, laboratory tests etc will generate 
records within the new systems automatically and the only way to prevent this is to 
choose not to have that particular care or treatment.**° 


225. Richard Granger highlighted the problems that would be caused by allowing patients 
to opt out of any form of electronic record storage: 


If an individual is so distressed that they do not want an x-ray to be conducted 
electronically, I think ministers would need to decide whether it was indeed in the 
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public interest to maintain wet film processing, a 19" century technology, for these 
distressed individuals.**! 


Sealed envelopes 


226. The Department also commented that local “sealed envelopes” will be available to 
safeguard particularly sensitive information held in DCR systems.3 But Guy Hains of CSC 
stated that exact specifications for DCR “sealed envelopes” had not yet been given to LSPs 
by Connecting for Health and that the technology was unlikely to be available before 
2009.*°? 


Conclusions and recommendations 


Vision and potential 


227. Patient record systems which record detailed clinical information that can be 
shared or joined electronically within and between a range of local organisations are the 
“holy grail” for NPfIT. Such Detailed Care Record (DCR) systems can bring dramatic 
improvements to the safety, quality and efficiency of NHS care, not only through faster 
access to and sharing of patient information, but also by supporting key clinical 
processes such as imaging and prescribing. More sophisticated clinical systems can 
further improve care, for example by supporting clinical decision-making and 
providing automatic messages and alerts to challenge unsafe practices. 


228. Achieving the widespread uptake of DCR systems is therefore the single most 
important advance that the NHS can make towards the provision of faster, better 
integrated and more patient-centred care. The potential benefits from detailed systems 
are wider than those offered by the national SCR system. Moreover, the goal of 
providing DCR systems to all NHS providers in England was clearly set out in the 
specification document on which NPfIT was based and tendered. It is thus on NPfIT’s 
success in implementing DCR systems that the programme’s effectiveness should 
ultimately be judged. 


229. Yet there is a perplexing lack of clarity about exactly what NPfIT will now deliver. 
It is not clear what information will be recorded and shared on DCR systems, nor the 
range of organisations that will be able to share information. Suppliers told us there 
will be significant variation between the size of different areas. The Department stated 
that DCR systems may be confined to areas as small as a single hospital or as large as an 
entire SHA. While local control over the new systems is a desirable goal, it is surprising 
that the architects of the DCR were not able to provide a clearer vision of what is 
planned. There is an explanatory vacuum surrounding DCR systems and this must be 
addressed if duplication of effort at a local level is to be avoided. We recommend that 
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e Publish clear information about its plans for DCR systems, stating in particular 
what area will be covered by shared records and what degree of information 
sharing will be possible; these plans should make reference to the original 
specifications for the Integrated Care Records Service, making clear how the 
scope of the project has changed since 2003; and 


e Set out clear milestones for achieving the increasing levels of interoperability 
and automation offered by DCR systems. 


Progress and implementation 


230. Progress on delivering the various elements of shared DCR systems has varied 
considerably. Projects such as the N3 network and the deployment of Picture Archiving 
and Communication Systems are on the way to successful completion: Connecting for 
Health deserves some credit for these successes. However, the continuing delays to 
delivering new Patient Administration Systems (PAS) and functions such as electronic 
prescribing in hospitals are a major concern. As a result of such delays, the shared DCR 
remains a distant prospect. Only BT provided an estimate, 2010, of when shared 
records will be available. This timetable only applies to the London area, however, and 
the level of information sharing which will be possible by this date was unclear. 


231. There have been many causes of the delays in delivering new systems. One of these 
has been the expansion to the scope of the programme since 2002. Changes were 
perhaps inevitable given the scale of NPfIT, but it is disappointing that essentially 
administrative applications such as Choose and Book were given priority ahead of 
clinically useful DCR systems. It is also apparent that the original timescales for 
deploying DCR systems were over-ambitious and did not take sufficient account of the 
complexity of replacing existing systems. The failure to give hospitals responsibility for 
implementing their own systems, and the lack of focus on changing local working 
practices to accommodate newly deployed systems, have also caused delays. 


232. The lack of progress on implementing new hospital PAS software, which has in 
turn prevented suppliers from deploying more sophisticated clinical systems, remains 
the biggest obstacle to delivering shared local records. The implementation of new 
hospital systems is more than two years behind schedule. In London and the South, 
where Cerner’s Millennium system is to be deployed, there is some evidence of 
progress, as well as a timetable for completing implementation in London. Yet in the 
remaining three clusters, which are awaiting iSoft’s Lorenzo product, delays drag on. 
Such delays have left many hospitals relying on increasingly outdated systems for their 
day-to-day administration. Most worryingly, the failure to deliver systems on time has 
reduced the confidence of local clinicians and managers in the programme, something 
which has itself contributed to delays. 


233. We recommend that Connecting for Health: 


e Ensure that all LSPs publish detailed timetables for delivering new PAS 
applications, electronic prescribing systems and shared local record systems, 
indicating what level of information sharing will be possible when DCRs are 
first implemented; and bs 
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¢ Set a deadline for the successful deployment of the Lorenzo system in an NHS 
hospital, making clear that if the deadline is not achieved then other systems 
with similar capability will be offered to local hospitals. 


The way forward 


234. In light of a range of concerns, including the delays to elements of the DCR 
programme, a number of witnesses called for an independent review of the whole of 
NPfIT. Whilst we understand the reasons for this, we do not agree that a 
comprehensive review is the best way forward. First, many of the questions raised by 
the supporters of a review would be addressed if Connecting for Health provided the 
additional information and independent evaluation which we recommend in this 
report. Secondly, the programme has already been scrutinised by the National Audit 
Office, the Public Accounts Committee and ourselves. We therefore recommend that: 


e The implementation of DCR systems be addressed in the short term by 
increasing both the local ownership and the professional leadership of the 
programme; and 


e The ongoing review by Lord Darzi on the future of the NHS include in its 
remit the long-term prospects for using electronic systems to improve the 
quality of care, particularly for the growing number of patients with long- 
term conditions. 


235. The Committee recognises the need to maintain a balance between central and 
local input into the development of DCR systems. We acknowledge the success of 
NPfIT’s national leadership in ensuring economies of scale and effective contract 
management. However, we disagree that this highly centralised approach is necessary 
to ensure consistent development of new systems across the NHS, provided that 
sufficient attention is given to nationally agreed technical and clinical standards. It is 
also clear that centrally driven implementation of local systems has stifled local activity 
and caused frustration and resentment at trust level. The successful delivery of DCR 
systems depends upon the ability of Connecting for Health to harness the benefits from 
local as well as national input, something which it has not achieved so far. 


236. There are already signs of a change of approach to increase local ownership of 
system implementation. Accountability is being devolved through the NPfIT Local 
Ownership Programme and control for some users is being increased through GP 
Systems of Choice. These measures are welcome but overdue. There is a need to go 
further and faster with reforms of this type. We recommend that: 


¢ Connecting for Health devolve responsibility for performance managing 
implementation of all NPfIT systems to Strategic Health Authorities (SHAs); 


« SHAs devolve responsibility for operational deployment by giving individual 
hospital trusts control over implementing their own new systems. SHAs should 
also devolve responsibility for implementing shared record systems across local 
health communities to their constituent Primary Care Trusts (PCTs); 
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¢ SHAs, PCTs and hospital trusts be given the authority to negotiate directly with 
LSPs and to hold suppliers to account, so that local organisations are not given 
responsibility without power; and 


¢ Connecting for Health offer all local organisations a choice of systems from a 
catalogue of accredited suppliers, as far as this approach is possible within the 
limitations of existing contracts. 


237. Connecting for Health’s own role should switch as soon as possible to focus on 
setting and ensuring compliance with technical and clinical standards for NHS IT 
systems, rather than presiding over local implementation. Clear standards would allow 
systems to be accredited nationally but would also ensure that local trusts have a choice 
of system and control over implementation. 


238. Technical standards should cover system security and reliability but should focus 
in particular on ensuring full interoperability between accredited systems. 
Comprehensive interoperability standards should guarantee that data can be 
seamlessly exchanged between systems whilst ensuring that users are not committed to 
a single supplier. In order to develop transparent technical standards, we recommend 
that Connecting for Health: 


e Establish an independent technical standards body responsible for setting the 
interoperability requirements for data exchange for all systems deployed in the 
NHS. These standards should be published and subjected to full external 
scrutiny; 


e Require all system suppliers to the NHS to meet and demonstrate conformity 
with these standards. Systems should be “kite marked” or classified to give 
details of their compatibility; and 


e Work with industry and academia to establish an independent technical 
standards testing service to evaluate and accredit systems for use in the NHS. 


239. Safe and effective data sharing, the fundamental aim of DCR systems, also requires 
a more standardised approach to the recording of clinical information. Such an 
approach is at the heart of ensuring real interoperability between systems and is vital if 
data from DCR systems is to be used as a basis either for the SCR or for research. The 
NHS Data Dictionary and the SNOMED CT coding system are important to achieving 
more consistent recording of patient information. We recommend that Connecting for 
Health publish a timetable for introducing SNOMED CT across the NHS. 


240. But Connecting for Health must do much more to ensure that the recording of 
detailed clinical data is standardised. Professionally developed datasets and agreed 
approaches to the structure and content of detailed records are urgently needed for 
each of the main clinical specialties and for use in a range of different care settings. 
Developing such standards will require close collaboration with Royal Colleges and 
other professional bodies. We recommend that Connecting for Health work with 
professional groups to: 
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¢ Identify the information standards which will be required within their specialty 
area; and 


¢ Develop and implement consensus-based clinical information standards. 


241. Separate clinical records on an individual patient can only be combined safely if 
each person can be accurately identified. The introduction of the new NHS number as 
the unique patient identifier and its allocation at birth through NHS Numbers for 
Babies is therefore a significant achievement. Yet the value of this work and the future 
integrity of clinical information will be undermined if organisations are unable to 
retrieve an individual’s NHS number when they need to use it or to allocate temporary 
NHS numbers for use in emergencies. We recommend that: 


¢ The Department of Health set a timetable for mandating the use of the 
correct NHS number on all clinical communications, and make this a 
performance measure for all NHS organisations; 


e Processes are introduced to allow temporary NHS numbers to be allocated 
which can subsequently be reconciled with the patient’s permanent NHS 
number through the Personal Demographic Service; and 


e Systems are maintained to treat patients under a separate, pseudonymous 
NHS number where this is necessary. 


Security, reliability and consent 


242. The resilience of new systems will be enhanced by distributing data across a range 
of hosting centres. Suppliers assured us that systems will be distributed in this way but 
the impact of the power failure at the Maidstone data centre, which affected 80 trusts, 
suggests otherwise. We recognise that lessons have been learned from the Maidstone 
incident. Nonetheless, we recommend that Connecting for Health instruct suppliers to 
publish details of all significant reliability problems along with a full incident log. 


243. The sharing of unique smartcards between users is unacceptable and undermines 
the operational security of DCR systems. However, we sympathise with the A&E staff 
who shared smartcards when faced with waits of a minute or more to access their new 
PAS software. Unless unacceptably lengthy log-on times are addressed, security 
breaches are inevitable. We recommend that Connecting for Health: 


¢ Ensure that suppliers have clear plans for achieving access times compatible 
with realistic clinical requirements for all of their systems; and 


e Continue to monitor the potential for introducing more sophisticated access 
systems, such as facial pattern recognition, in busy areas such as A&E. 


244. The Department has indicated that explicit consent will be required before DCR 
information can be shared between separate organisations. The Committee supports 
this approach and recommends that the consent model for the shared DCR be 


communicated to patients as clearly and as early as possible. 
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245. However, if sensitive information is to be stored and shared on DCR systems, it is 
important that local “sealed envelope” systems are developed and tested as soon as 
possible. We were concerned to hear that suppliers have not yet received specifications 
for local “sealed envelopes”. We recommend that Connecting for Health provide such 
specifications as a matter of urgency and set a clear timetable for the introduction of 
this technology at a local level. 
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5 The Secondary Uses Service 


246. Storing and managing health information electronically can bring a range of 
additional benefits alongside improvements to direct patient care. The management and 
commissioning of health services, as well as clinical audit and research, known collectively 
as “secondary uses”, can all be enhanced by quicker and easier access to health information. 
These secondary uses are profoundly important to improving care: as one witness put it, 
“there is no distinction to be made between health services and research for effective health 
services” .°*4 


247. In order to regulate access to electronic health databases for such “secondary uses”, 
the NCRS will include a national application known as the Secondary Uses Service (SUS). 
In this chapter we examine the SUS, focussing particularly on its potential impact on 
clinical research. We look at: 


e Descriptions of the SUS, including both its current and intended future form, and 
a discussion of the potential offered by the SUS; and 


e The existing governance and consent arrangements which regulate access to data 
for “secondary” uses, and how these could be improved. 


Description and potential 
248. In this section we examine: 
e Howthe SUS works at present; 


¢ Plans for the development of the SUS, particularly by giving access to data 
from the SCR and DCR systems for secondary purposes; and 


e The impact of access to NCRS data on the SUS. 


How the Secondary Uses Service currently works 


249. In its current form, the SUS has taken over many of the functions previously provided 
by the NHS-Wide Clearing Service (NWCS), which was decommissioned in December 
2006.35 Like the NWCS, the SUS mainly uses data provided by Hospital Episode Statistics 
(HES), which are derived from existing PAS applications and paper records. HES data 
includes administrative information and some clinical information, for example about 
diagnoses and procedures, presented in a coded form. The existing SUS also accesses 
aggregated administrative data from outpatient clinics. 


250. The data currently provided by the SUS are used for a range of management purposes. 
In particular, SUS datasets are used to support Payment by Results by exchanging activity 
and price information between commissioners and providers.*°° SUS data can also be used 
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for a range of other purposes including clinical audit and research. However, existing data 
sources such as HES do not provide detailed clinical information, and their value for 
research is therefore limited. The current functions of the SUS are much the same as those 
previously offered by the NWCS. 


Plans for the development of the Secondary Uses Service 


251. In future, it is intended that information from both SCR and DCR systems will be 
made available through the SUS. Thus the SUS will be a key element of the wider NCRS. 
BT described the SUS as a system for providing “anonymous patient data for research and 
planning purposes”.**” The Department of Health described the goal of the SUS as “to 
rationalise data abstraction, data flows, data management, analysis and reporting”. 
According to the Department, SUS data will support “healthcare planning, commissioning, 
public health, clinical audit, benchmarking, performance improvement, research and 
clinical governance”.*** 

252. In order to achieve this, the SUS will access data from a widening range of sources, 
both national and local, including clinical data from the SCR and DCR. Data extracted 
from these rich sources will be collated by the SUS, pseudonymised so that identifying data 
is removed, and then presented to users in a searchable format. Users will be able to access 
the SUS online and make specific data requests. As with the SCR and DCR systems, users 
will require a smartcard to access the SUS and role-based access controls will regulate the 
level of access for each user.*”” 


The impact of NHS Care Records Service data on the Secondary Uses 
Service 


253. The expected growth in the amount of clinical information available electronically, 
through the introduction of SCR and then of DCR systems, will dramatically increase the 
usefulness of the SUS. At present, SUS data is coded manually and contains very little 
clinical detail, while information from different care settings cannot be integrated. The 
SCR and DCR, by contrast, have the potential to provide detailed, integrated clinical data, 
made available to the SUS promptly and without the need for laborious manual coding 
procedures. Such data would be significantly more detailed and of a profoundly higher 
quality than that which the SUS currently offers. For this reason, the Department of Health 
said that the introduction of SCR and DCR systems “represents a major opportunity” for 
expanding the scope and usefulness of the SUS.* 


The threat to privacy 


254. As with other EPR systems, however, the increasing availability of health information 
through the SUS will bring new risks as well as new opportunities. Witnesses expressed 
particular concerns about the possible effects of increasing the breadth and depth of data 
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held electronically while simultaneously widening access to this data. Dr Martyn Thomas 
argued that easier access to data could make breaches of privacy more frequent and more 
serious. He pointed out that: 


..-a lot of patients whose privacy was never really under threat with paper records, 
because it would simply have been too hard to go and trawl through large numbers 
of those records, are now potentially at risk. . 3°! 


255. Professor Douwe Korff warned that the increasing availability of health information 
would lead to a corresponding increase in the range of organisations seeking access. He 
argued that: 


Once the data exist in this kind of accessible form there will be pressure...to identify 
illegal immigrants in this way; and there will be pressure from the police and 
certainly the anti-terrorist authorities...It is a recipe for disaster.°? 


The research opportunity 


256. Other witnesses were much more positive, pointing out the many opportunities 
offered by access to detailed health information via the SUS. In particular, the benefits for 
health research were underlined. Research organisations consistently argued that the depth 
and breadth of data accessible via the SUS could act as a “unique selling point” for UK 
research.*® The Academy of Medical Sciences observed: 


The development of NPfIT and EPR offer unparalleled opportunities for research 
that could have a real and significant impact on future health in the UK. 


257. The Department of Health also acknowledged the great potential of the SUS to 
improve health research in its January 2006 publication, Best Research for Best Health. The 
paper envisaged that the UK could offer “unique benefits” as a site for clinical research, 
because of its plans for detailed electronic records systems, and due to the fact that the 
NHS provides care for the vast majority of citizens. Best Research for Best Health 
concluded: 


The new national IT system for the NHS in England offers a unique and unrivalled 
opportunity for research into health that the Department of Health is determined to 
realise.*® 


258. A UK Clinical Research Collaboration R&D Advisory Group to Connecting for 
Health has also been established to helped ensure that the research opportunities offered by 
SUS are maximised.*© As part of this work, Connecting for Health commissioned a series 
of research simulations to assess the impact of expanding SUS data on different types of 
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research. The simulation outcomes were published by the UK Clinical Research 
Collaboration’s in June 2007.°°” 


259. Witnesses from research organisations described a range of specific types of research 
which would benefit from improved access to electronic health data, including: 


e Research into public health, including both risk factors and interventions;*® 

e Studies looking at the side effects of particular drug treatments. Researchers 
argued that the association between non-steroidal anti-inflammatory drugs and 
cardiovascular disease could have been discovered more quickly using electronic 
data;*©? 


e Genetic research. Researchers argued that the UK is “uniquely positioned” to 
conduct genetic studies;’”° and 


e Research linking maternal health with children’s incidence of disease in later life, 
for example the effects of complications during pregnancy on the incidence of 
schizophrenia.*”’ 


Maximising research benefits 


260. While the potential is huge, research organisations also warned that the opportunities 
to improve research would be lost if excessive constraints were placed on access to data or 
if capacity for linking data from diverse sources was limited. The Academy of Medical 
Sciences (AMS) commented: 


...disproportionate constraints on the use of health information can compromise the 
quality and validity of research results, leading to potentially misleading claims, or 
even costing lives.*” 


261. Researchers therefore made a range of suggestions for ensuring that the opportunities 
offered by the SUS are maximised. These included: 


a) Establishing a single unique patient identifier for each NHS patient and mandating its 
use whenever a patient comes into contact with the health service. Professor Carol 
Dezateux described this as the “most critical factor” in improving research through the 
SUS as it would allow previously separate parts of the patient record to be integrated.*” 





367 UK Clinical Research Collaboration, The potential of electronic patient records: research for patient benefit, 7 June 
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Lord Hunt expressed confidence that this could be achieved through wider use of the 
NHS number, describing this as an “unseen but huge advance”.*”* The NHS number is 
discussed in more detail in Chapter 4, above. 


Achieving better linkage of databases, particularly in order to answer complex or 
unexpected public health questions. Professor Dezateux commented that: “We should 
not have data sets that are not patient-level and that are not linkable, because we cannot 
answer the important questions that society wants us to address”.*”> Witnesses gave the 
examples of Denmark and Finland as countries with good database linkage.*”° The 
Health Protection Agency also argued that better database linkage would help them to 
monitor public health risks, such as potential infectious disease outbreaks, by accessing 
relevant clinical data in real time.*” 


Improving public communication about the research opportunities offered by the SUS 
and the potential benefits from strengthening the infrastructure which supports 
research using electronic health data.*” 


Updating and strengthening the governance framework which regulates access to data 
for research and other purposes. Witnesses argued for more transparent governance 
and consent systems which would maximise privacy without constraining research.*” 
We discuss these issues in more detail below. 


Governance and consent 


262. Exploiting the opportunities offered by the SUS will require a careful and balanced 
approach to governance arrangements for regulating availability of and access to SUS data. 
Witnesses put forward a range of arguments and suggestions regarding patient consent, 
pseudonymisation, and other aspects of governance. In this section we look at: 





¢ Existing measures for regulating access to SUS data; 


¢ Doubts and debates regarding the governance framework, including arguments 
about the appropriate model for patient consent and the effectiveness of the 
pseudonymisation of data; and 


« Suggestions for changes to the governance framework in light of current problems 
and the expected growth in demand for access to health information. 
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Existing measures 


263. The current framework for regulating access to information through the SUS was set 
out by officials on 26 April 2007. They commented that the legal framework for the use of 
data for health research currently permits access through three different routes: 


e Information can be made available with explicit consent from the patient. 


e Access is permitted if information has been pseudonymised i.e. if data which 
could allow an individual patient to be identified have been removed. This is 
intended to be the usual basis for access to data through the SUS. In the US, a 
legal distinction has been drawn between fully and partially pseudonymised 
data. Fully pseudonymised data, from which 18 specific identifiers have been 
removed and from which the risk of re-identification is extremely limited, is 
known as “de-identified” information. However, as we discuss below, such 
data are often inadequate for research purposes. As a result, partly 
pseudonymised “limited data sets” are also recognised. “Limited data sets” 
may contain some identifying information but are made available to users 
subject to contractual and technical limitations, and with the agreement that 
no attempt will be made to identify individuals.**° Although this contrast has 
not been formally recognised in England, the distinction between fully and 
partially pseudonymised data is used to clarify the discussion below. 


e Identifiable or potentially identifiable information can be accessed with specific 
permission from the Patient Information Advisory Group, a body established by 
the 2001 Health and Social Care Act.**! 


264. Witnesses also pointed out that access to data for research purposes is subject to local 
controls and ethical approval. Professor Simon Wessely explained: 


...there is this very complicated system of checks and balances by which we have to 
be governed...I cannot simply say, “Give me the data” on this that or the other, I 
have to apply to an ethics committee, a Caldicott committee, an R&D committee and 
so on.** 


Doubts and debates 


265. Questions and criticisms were raised by a variety of witnesses about the suitability and 
effectiveness of current access and governance measures. On the one hand, some witnesses 
argued that current measures do too little to protect patient privacy. The Foundation for 
Information Policy Research (FIPR), for example, argued that: 
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The UK has so far failed to develop a robust political and legal mechanism for 


balancing patients’ privacy interests with the many requests by others for access to 
their data.** 


266. On the other hand, research organisations often argued that regulations are currently 
too strict and therefore inhibit research. The AMS stated: 


...confusing legislation and professional guidance, bureaucracy of process and an 
undue emphasis of privacy and autonomy, are having a detrimental effect on UK 
research activity... .**4 


267. Both sides agreed that patients and the public would benefit from a fuller 
understanding of the current and potential future use of data for research and other 
secondary purposes. FIPR commented that: 


...a gap has opened up between actual practice on the one hand, and the 
expectations and views of patients on the other... Many more people have access to 
medical records than most patients realise...Legal challenges are likely as more 
people become aware of what is happening.°*° 


268. The AMS also argued for improving public understanding of how electronic data can 
be used for research, but contended that this would lead to increased support for relaxing 
access controls: 


Urgent work is needed to increase public engagement about the value of research 
using healthcare records...in our discussions with patient representatives there was 
strong support for research using health data. There was great concern that a vocal 
minority, loudly proclaiming the right of privacy, might override the unexpressed 
desire of many people to contribute to the public good.**° 


Consent systems 


269. Some witnesses argued that, unless data could be fully pseudonymised, patient 
consent should be required for data to be used for research purposes. Support for explicit 
patient consent in such cases was expressed by organisations including the Royal College of 
Psychiatrists and the Royal College of Surgeons.**” Professor Douwe Korff went further, 
arguing that current UK consent procedures may not be strict enough to comply with 
European law.*** Helen Wilkinson, founder of the Big Opt Out Campaign, argued that 
patients should have the right to prevent their data being used by the SUS, even in 
pseudonymised form. She warned that: 
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...patients tell me that they are prepared to lie about their symptoms, 
medication...and medical history as they cannot opt out of the DCR or prevent their 
records being used by the SUS.**° 


270. But other witnesses said that the reliance on specific patient consent should be limited 
and argued that maintaining or tightening consent requirements could have a negative 
impact on future research. Obtaining explicit consent, particularly for large studies, can in 
practice prove impossible.>” Professor Carol Dezateux commented that consent is often 
more difficult to obtain from socially disadvantaged or ethnic minority groups, something 
which can inhibit research, particularly into health inequalities, or even bias research 
findings.*? The AMS argued that the rights of individuals to restrict access to their data 
should not necessarily be seen to outweigh the public benefits of health research: 


It could be maintained that a patient has the right to say ‘use my data to treat me, but 
not to improve care for others’. Or more starkly, ‘use evidence from other people’s 
data to treat me, but don’t use my data to help them.*”” 


Pseudonymisation 


271. Questions were also raised about the intention to pseudonymise data made available 
through the SUS. “Pseudonymisation” is achieved by removing identifying information 
such as the patient’s name, address and contact details. However, as mentioned above, 
there is a distinction between fully and partially pseudonymised data. Witnesses stated that 
partial pseudonymisation will often not prevent patients from being re-identified, 
particularly if information such as the postcode and date of birth are retained.*” Professor 
Douwe Korff added that, if full pseudonymisation did not take place, patients’ consent 
should be sought before data were made available: 


The issue hinges on identifiability... When the data used in research...are so flimsily 
anonymised that it is very easy to re-identify people, in my view they remain 
personal data and therefore cannot be used without the express, valid and free 
consent of the data subject.*” 


272. Doubts about pseudonymisation were also expressed by the Assistant Information 
Commissioner. He admitted that the Information Commissioner’s Office had not 
examined the pseudonymisation techniques which will be used to encrypt SUS data but 
acknowledged that “we will be asking a few questions” in light of the concerns presented to 
the Committee.* Mr Bamford agreed that if the effectiveness of pseudonymisation could 
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not be assured then the case for making data available through the SUS would be 
weakened: 


If it is truly pseudonymised and it is not that easy to look back at the records or bring 
them together...I do not think it would be open to very much challenge. If the 
pseudonymisation is not effective then that is a much more open question.*”° 


273. Researchers argued that the degree of protection offered by pseudonymisation 
depended on the type of research being conducted. Dr Mark Walport maintained that full 
pseudonymisation could completely protect a patient’s identity,” but he also pointed out 
that many studies rely for their effectiveness on information, such as the patient’s postcode, 
which might make re-identification possible.’ It is in this context that partially 
pseudonymised information, known in the US as a “limited data set”, is required. The AMS 
also pointed out a range of other important uses of identifiable information, including: 


e Avoiding double counting of patients; 


e Performing longitudinal studies which link risk factors, such as smoking, to health 
later in life; and 


e Validating the quality of data and so the outcomes of research.*” 


274. Researchers therefore stated that the degree to which data is pseudonymised should be 
maximised but should vary depending on the specific requirements of different research 
projects. BT, the company responsible for pseudonymisation, confirmed that the 
amount of data removed could be varied in practice. 


275. Professor Carol Dezateux argued that access to partly pseudonymised “limited data 
sets” for researchers could be balanced by more sophisticated audit of the way in which 
data is accessed and used, along with clear sanctions for the misuse of data. She pointed out 
that this will be made easier by the increasing use of electronic databases: 


I can have an audit trail which shows what I, as a researcher, have done with that and 
which holds me accountable. I would lose my job if I did something wrong. I think 
you have to have those sanctions.” 


276. So witnesses were in broad agreement that fully pseudonymised “de-identified” data 
would not be adequate for many research purposes. Thus the SUS will also need to provide 
researchers with partially pseudonymised “limited data sets” from which patients could in 
theory be re-identified. As witnesses pointed out, this increases the need for 
complementary governance systems to protect potentially identifiable information from 


abuse, which we discuss below. 
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The Patient Information Advisory Group 


277. Finally, witnesses expressed concerns about the Patient Information Advisory Group 
(PIAG), the body which considers requests for access to health information in cases where 
researchers require identifiable data and consent cannot be gained. Professor Douwe Korff 
described PIAG as “quite easy about giving access” to identifiable information and argued 
that the group should do more to protect patient privacy.“ But Professor Simon Wessely 
expressed the opposite view, arguing that PIAG was sometimes too protective of patients’ 
privacy rights.“ A recent report by the AMS, Personal data for public good, put this point 
more explicitly: 


...PIAG currently stresses its role on protecting privacy and confidentiality, without 
equal emphasis on the public benefits derived from well-conducted research. The 
Academy considers that PIAG should more actively promote its role as a facilitator 
of research.*” 


278. Professor Wessely also described PIAG as an “emergency measure”, established at 
short notice in light of changes to General Medical Council guidance on the use of data in 
research.~ In addition, Dr Mark Walport argued that PIAG was initially seen as a 
temporary organisation, a view which has now changed: 


...when PIAG was set up it was the philosophy that somehow PIAG might only be 
needed for a short time because we were moving to a world where consent would be 
possible for everything. I think it has been recognised that that really is not the case, 
that there are always going to be unforeseen questions.*” 


Suggestions for change 


279. In light of these and other concerns, a number of witnesses suggested changes to the 
regulatory and governance arrangements for access to SUS data. Importantly, the case for 
reform was put forward both by exponents of greater protection for patient privacy, such 
as FIPR, and by research organisations seeking to improve access to information.** The 
following were amongst the suggestions for reforming governance systems: 


e Introducing a system of class approval so that organisations such as PIAG could 
make judgements about granting access to identifiable data which would apply to 
whole categories of research, rather than considering each individual project in 
isolation. This was also referred to as a community assent model;*” 
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¢ Introducing a national Information Governance Board to oversee the 
arrangements for regulating access to health data. It was suggested that PIAG, or a 
successor organisation, could be reconstituted as a permanent subcommittee of the 
national Board. *!° In a late submission, PIAG stated that “the creation of a new 
national advisory body, which will absorb PIAG and other similar groups” is likely 
to take place in future. The Department of Health, however, did not mention 
this;*"! 


¢ Extending the use of third party brokerage as a system for protecting the privacy 
of health information. This approach was supported both by researchers and by the 
Assistant Information Commissioner;*!” 


¢ Providing full pseudonymisation of data, for example so that only the patient’s 
year of birth and home area are retained;*"? and 


¢ A full review of governance systems, examining the role of local ethics 
committees, Caldicott Guardians, PIAG and the relationships between them. 
Witnesses suggested that this would help to bring “greater coherence” to a system 
which has developed in an “ad hoc” fashion.*"4 


Conclusions and recommendations 


280. The Secondary Uses Service (SUS), which succeeded the NHS-Wide Clearing 
Service, has for some years helped to improve the health service by providing access to 
and analysis of data for commissioning, management and audit purposes. However, the 
development of the SCR and DCR will allow access to clinical data which are timelier, 
better integrated and of a profoundly higher quality than those currently available. 
This will transform the SUS and offers significant benefits, most notably for health 
research. In particular, if the highly detailed data captured by DCR systems can be 
made available through the SUS then the possibilities for new and improved research 
are outstanding. 


281. The Department has acknowledged the need to take advantage of the research 
opportunities offered by the SUS and has established a partnership with the UK 
Clinical Research Collaboration to achieve this. We welcome this, but researchers 
nevertheless told us that much more could be done to maximise these opportunities. 
We recommend that Connecting for Health: 


e Mandate the use of the unique patient identifier, the NHS number, in all health 
service interactions in England; 
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e Develop appropriate linkage between databases within and beyond the SUS. 
This would also have benefits for non-research activities such as health 
protection; 


e Ensure that the development of clinical information standards, which we 
recommended in Chapter 4, takes account of the needs of research; and 


e Initiate a campaign of public engagement so that both the opportunities and 
risks from using health data for research purposes are better understood. 


282. Increasing access to health data brings new challenges for safeguarding patient 
privacy. It is therefore vital that the systems which regulate availability of, and access to, 
data through the SUS are safe and effective. Governance systems must strike a difficult 
balance between the need to protect patient privacy and the need to take advantage of 
the increasing availability of data, between safeguarding individual rights and 
promoting the public good. Unless such a balance can be struck, there is a risk either 
that the potential of the SUS will not be realised, or that public confidence will be 
damaged. 


283. There are a number of weaknesses within current access and governance systems. 
While explicit patient consent is the ideal means of allowing access to data, it is often 
impossible to ask for consent in practice, particularly for studies using historical data. 
Pseudonymisation is a good idea in principle, but full pseudonymisation is only 
possible in some situations because potentially identifying data are often needed for 
effective research. It follows that some research will continue to require access to 
partially pseudonymised data in situations where obtaining explicit consent is 
impossible. However, the Patient Information Advisory Group (PIAG), which 
considers such requests, remains a temporary body. PIAG has attracted criticism both 
for its processes and for its decisions. 


284. There is an urgent need to address these problems, especially as the amount and 
type of data potentially available through the SUS will proliferate rapidly in future. We 
recommend that the Department of Health conduct a review of both national and local 
procedures for controlling access to electronic health data for “secondary” uses. In 
particular, the review should examine: 


¢ How best to balance the opportunity to improve access to data for research 
purposes with the ongoing need to safeguard patient privacy; 


e Whether to establish a national Information Governance Board to oversee the 
arrangements for access to data for secondary uses; 


¢ The case for establishing a permanent body to succeed the Patient Information 
Advisory Group and whether this should be a subcommittee of the national 
Board; 


¢ The effectiveness of the pseudonymisation process proposed by Connecting for 
Health and its suppliers, which should be subject to independent public 
evaluation; 
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What compensating controls, such as third party brokerage, should be used to 
protect patient privacy in situations where research must be conducted with 
partially rather than fully pseudonymised information; and 


How governance arrangements for access to data for research purposes should 
differ from those which apply to other “secondary” purposes, such as 
immigration and counter-terrorism. 
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Conclusions and recommendations 





Electronic Patient Record systems 


Ll; 


The National Programme for IT (NPfIT) is a complex and ambitious set of projects 
intended to transform the use of information technology in the NHS. At the heart of 
the programme is the NHS Care Records Service (NCRS), which aims to introduce a 
range of electronic patient record (EPR) systems. EPR systems offer significant 
potential improvements to the safety, quality and efficiency of care and are being 
implemented in most health systems in the developed world. (Paragraph 40) 


NPfIT is characterised by a centralised management structure and large-scale 
procurement from private suppliers. This approach aims to offer improved value for 
money and to address the previously patchy adoption of IT systems across the health 
service. The Department defended the progress made by NPfIT to date, arguing that 
the programme is on course to succeed. However, serious doubts have been raised, 
from sources including the Public Accounts Committee, about how much has been 
achieved and about the likely completion date. In particular, progress on the 
development of the NCRS has been questioned. (Paragraph 41) 


During our inquiry, both at home and abroad, similar messages were given to us 
repeatedly from different sources. We commend these to the Department: 


e The EPR is essential and is the top priority for improving health care. 


e The installation of a comprehensive IT system is a long journey best managed 
by a staged and piloted development not a big bang approach. 


e The input of end-users is vital in planning, design and implementation. 


e Local flexibility is essential to allowing continued use of effective systems 
already in place, as is interoperability if local systems are to communicate 
with one another. 


° As EPR systems make more personal health data accessible to more people, 
breaches of security and confidentiality must be regarded as serious matters. 


e The support of the public must be obtained. The fact that EPR systems are 
essential for the delivery of modern health care and can improve 
communication between different health care staff and between staff and 
patients must be adequately publicised to users of the NHS. We believe this 
would help to convince people of the necessity and benefits of the EPR and 
reduce resistance where it exists. (Paragraph 42) 


The Summary Care Record 


4. 


The Committee is pleased that trials of the national Summary Care Record (SCR) are 
now going ahead following delays to the project. The SCR has the potential to 
improve the safety and efficiency of care and to make the health service more 


10. 
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patient-centred. The SCR has the potential to improve the safety and efficiency of 
care especially in emergency situations when care is delivered by staff unfamiliar 
with the patient involved. The Committee supports the aim of introducing a 
nationally available summary record as soon as possible and deplores the delays and 
continuing indecision about its content. (Paragraph 113) 


The SCR has less comprehensive clinical value than shared Detailed Care Record 
(DCR) systems and is a comparatively straightforward application which extracts 
information from existing GP systems, whereas DCR systems must be built up from 
a range of complex and interdependent component applications. Given that there is 
expected to be clinical value from the SCR, its roll-out should not be held back by 
delays to DCR systems. (Paragraph 114) 


The Committee was dismayed, however, by the lack of clarity about what 
information will be included in the SCR and what the record will be used for. 
Officials gave different answers to these questions on different occasions. The 
Committee was told at various times that the SCR will be used for the delivery of 
unscheduled care, for the care of patients with long-term conditions, and to 
exchange information between primary and secondary care. It is little wonder that 
patient groups expressed confusion about the purpose and content of the SCR. 
(Paragraph 115) 


The Committee is aware of the Department’s most recent plans but is concerned that 
the complexity of the SCR appears to be increasing. This will make the SCR more 
difficult to use, particularly in emergency situations. The Department must be clear 
about the purpose of the SCR, and it must ensure that the record is easy to use. To 
this end, we recommend that the SCR include a single standardised front screen to 
display key health information which is vital for emergency care. (Paragraph 116) 


The Committee has also received inconsistent information about the patient consent 
arrangements for the SCR. Initially, we were told that information will be added to 
the SCR with “implied consent”, provided patients do not opt out. This approach 
was strongly criticised by clinical and patient groups. However, it subsequently 
became clear that while the creation of the SCR, and the addition of “life-saving” 
details such as prescription information, will require “implied consent”, the addition 
of detailed clinical information will only take place with “explicit consent” from the 
patient. This hybrid consent system represents a much more satisfactory model but 
one which has not been well communicated to patients or clinicians. (Paragraph 117) 


The inclusion of prescription information on the SCR with only “implied consent” 
remains problematic, however. On the one hand, prescription information can often 
make a patient’s diagnosis obvious. On the other hand, excluding some prescription 
information from the SCR would be clinically dangerous. If the Department of 
Health does use the “implicit consent” model for prescription information, it should 
make clear to patients the implications both for data privacy and clinical safety. 


(Paragraph 118) 


The Committee considers that much of the controversy over privacy and consent 
arrangements for the SCR would have been avoided if Connecting for Health had 
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LL; 


12. 


communicated its plans more clearly to patients. We recommend that Connecting 
for Health: 


e Make clear to patients, clinicians and the public that detailed information will 
only be added to the SCR with explicit patient consent, that patients can see 
this information before it is added, and that patients can choose to have an 
SCR created but not accessed beyond their GP surgery; and 


e . Offer the same assurances to all patients in the SCR early adopter sites. 
(Paragraph 119) 


The arrangements for the SCR will be strengthened when “sealed envelopes” are 
made available to protect sensitive information and when patients can access their 
record via the HealthSpace website. It is unfortunate that these elements of the SCR 
are not yet in place, but the Committee understands and supports the decision to 
press ahead in any case with trials of the SCR. Connecting for Health must ensure 
that both “sealed envelopes” and HealthSpace are introduced as soon as possible, 
particularly so that their effectiveness can be assessed during the independent 
evaluation of the early adopter programme. (Paragraph 120) 


“Sealed envelopes” are a vital mechanism if sensitive information is to be held on the 
SCR. We recommend that: 


e The right to break the seal protecting information in “sealed envelopes” 
should only be held by patients themselves, except where there is a legal 
requirement to override this measure; and 


© Information in “sealed envelopes” should not be made available to the 
Secondary Uses Service under any circumstances; this will allow patients to 
prevent data being used for research purposes without their consent. 
(Paragraph 121) 


HealthSpace is an excellent addition to the SCR programme and has huge potential 
to improve the safety and efficiency of care by allowing patients to check the 
accuracy of their SCR and to access detailed information about their own health. In 
order to take fuller advantage of HealthSpace, we recommend that Connecting for 
Health: 


e Trial the use of HealthSpace for patients, particularly those with long-term 
conditions, to record their own measurements of key health information; 


e Ensure that HealthSpace allows patients to view audit trails, showing who has 
accessed their SCR record and under what circumstances, and offers 
mechanisms for investigating inappropriate access; 


. Promote the use of HealthSpace, monitor levels of uptake, and ensure that 
there is equitable access across the country and that coercive access is 
prevented; and 


e Commission an independent evaluation of HealthSpace once the system is 
widely available. (Paragraph 122) 


14. 


be 


16. 


Lf. 


18. 
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We note that in France patients will own their national summary record. This 
approach gives patients more control over who can access their record and more 
opportunity to influence and take control of their own care. We therefore 
recommend that Connecting for Health consider a similar model for the SCR in 
England. (Paragraph 123) 


The Committee does not have the knowledge or expertise to make specific 
judgements about the likely effectiveness of planned technical security systems at 
protecting the SCR from external attack. We received strong assurances from 
officials and suppliers about the quality of security systems, and we accept the 
inevitability of a trade-off between levels of security and the need to ensure that 
systems are user-friendly. We also acknowledge that no information storage system 
can be considered 100% secure. (Paragraph 124) 


However, serious concerns were expressed regarding the lack of information both 
about how security systems will work and about the outcomes of security testing. We 
agree with these concerns and recommend that Connecting for Health ensure that 
BT’s planned security systems for its national applications are subject to independent 
evaluation and that the outcomes of this are made public. (Paragraph 125) 


Maintaining the operational security of the new SCR system is a substantial 
challenge. We acknowledge that Connecting for Health and its suppliers have made 
significant efforts to minimise the risk of operational security breaches. Individual 
smartcards, rigorous user authentication, role-based access controls, legitimate 
relationships and audit trails will all help to increase operational security, both 
individually and in combination. However, many of these measures are new and 
untested on the scale that they will be used in the NHS. As a result, their impact and 
vulnerabilities are difficult to predict. We therefore recommend that Connecting for 
Health: 


* Ensure that the evaluation of the early adopter sites examines both the 
individual and the collective impact of the new operational security measures 
for the SCR, commissioning a separate evaluation if necessary; and 


e Undertake a program of operational security training for all staff with access 
to the SCR, emphasising the importance of not divulging information to 
those who request it under false pretexts. (Paragraph 126) 


Operational security also depends on effective enforcement. The Department of 
Health and the Information Commissioner’s Office have called for custodial 
sentences for people who unlawfully access personal information. The Committee 
welcomes this, and recommends that a substantial audit resource be provided to 
detect and prosecute those who access the system unlawfully. (Paragraph 127) 
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The Detailed Care Record 


Vision and potential 


19. 


20. 


4 le 


Patient record systems which record detailed clinical information that can be shared 
or joined electronically within and between a range of local organisations are the 
“holy grail” for NPfIT. Such Detailed Care Record (DCR) systems can bring 
dramatic improvements to the safety, quality and efficiency of NHS care, not only 
through faster access to and sharing of patient information, but also by supporting 
key clinical processes such as imaging and prescribing. More sophisticated clinical 
systems can further improve care, for example by supporting clinical decision- 
making and providing automatic messages and alerts to challenge unsafe practices. 
(Paragraph 227) 


Achieving the widespread uptake of DCR systems is therefore the single most 
important advance that the NHS can make towards the provision of faster, better 
integrated and more patient-centred care. The potential benefits from detailed 
systems are wider than those offered by the national SCR system. Moreover, the goal 
of providing DCR systems to all NHS providers in England was clearly set out in the 
specification document on which NPfIT was based and tendered. It is thus on 
NPfIT’s success in implementing DCR systems that the programme’s effectiveness 
should ultimately be judged. (Paragraph 228) 


Yet there is a perplexing lack of clarity about exactly what NPfIT will now deliver. It 
is not clear what information will be recorded and shared on DCR systems, nor the 
range of organisations that will be able to share information. Suppliers told us there 
will be significant variation between the size of different areas. The Department 
stated that DCR systems may be confined to areas as small as a single hospital or as 
large as an entire SHA. While local control over the new systems is a desirable goal, it 
is surprising that the architects of the DCR were not able to provide a clearer vision 
of what is planned. There is an explanatory vacuum surrounding DCR systems and 
this must be addressed if duplication of effort at a local level is to be avoided. We 
recommend that Connecting for Health: 


e Publish clear information about its plans for DCR systems, stating in 
particular what area will be covered by shared records and what degree of 
information sharing will be possible; these plans should make reference to the 
original specifications for the Integrated Care Records Service, making clear 
how the scope of the project has changed since 2003; and 


e Set out clear milestones for achieving the increasing levels of interoperability 
and automation offered by DCR systems. (Paragraph 229) 


Progress and implementation 


22. 


Progress on delivering the various elements of shared DCR systems has varied 
considerably. Projects such as the N3 network and the deployment of Picture 
Archiving and Communication Systems are on the way to successful completion: 
Connecting for Health deserves some credit for these successes. However, the 
continuing delays to delivering new Patient Administration Systems (PAS) and 


23. 


24. 


25. 
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functions such as electronic prescribing in hospitals are a major concern. As a result 
of such delays, the shared DCR remains a distant prospect. Only BT provided an 
estimate, 2010, of when shared records will be available. This timetable only applies 
to the London area, however, and the level of information sharing which will be 
possible by this date was unclear. (Paragraph 230) 


There have been many causes of the delays in delivering new systems. One of these 
has been the expansion to the scope of the programme since 2002. Changes were 
perhaps inevitable given the scale of NPfIT, but it is disappointing that essentially 
administrative applications such as Choose and Book were given priority ahead of 
clinically useful DCR systems. It is also apparent that the original timescales for 
deploying DCR systems were over-ambitious and did not take sufficient account of 
the complexity of replacing existing systems. The failure to give hospitals 
responsibility for implementing their own systems, and the lack of focus on changing 
local working practices to accommodate newly deployed systems, have also caused 
delays. (Paragraph 231) 


The lack of progress on implementing new hospital PAS software, which has in turn 
prevented suppliers from deploying more sophisticated clinical systems, remains the 
biggest obstacle to delivering shared local records. The implementation of new 
hospital systems is more than two years behind schedule. In London and the South, 
where Cerner’s Millennium system is to be deployed, there is some evidence of 
progress, as well as a timetable for completing implementation in London. Yet in the 
remaining three clusters, which are awaiting iSoft’s Lorenzo product, delays drag on. 
Such delays have left many hospitals relying on increasingly outdated systems for 
their day-to-day administration. Most worryingly, the failure to deliver systems on 
time has reduced the confidence of local clinicians and managers in the programme, 
something which has itself contributed to delays. (Paragraph 232) 


We recommend that Connecting for Health: 


e — Ensure that all LSPs publish detailed timetables for delivering new PAS 
applications, electronic prescribing systems and shared local record systems, 
indicating what level of information sharing will be possible when DCRs are 
first implemented; and 


» Set a deadline for the successful deployment of the Lorenzo system in an 
NHS hospital, making clear that if the deadline is not achieved then other 
systems with similar capability will be offered to local hospitals. 
(Paragraph 233) 


The way forward 


26. 


In light of a range of concerns, including the delays to elements of the DCR 
programme, a number of witnesses called for an independent review of the whole of 
NPfIT. Whilst we understand the reasons for this, we do not agree that a 
comprehensive review is the best way forward. First, many of the questions raised by 
the supporters of a review would be addressed if Connecting for Health provided the 
additional information and independent evaluation which we recommend in this 
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28. 


29, 


report. Secondly, the programme has already been scrutinised by the National Audit 
Office, the Public Accounts Committee and ourselves. We therefore recommend 
that: 


e The implementation of DCR systems be addressed in the short term by 
increasing both the local ownership and the professional leadership of the 
programme; and 


e . The ongoing review by Lord Darzi on the future of the NHS include in its 
remit the long-term prospects for using electronic systems to improve the 
quality of care, particularly for the growing number of patients with long- 
term conditions. (Paragraph 234) 


The Committee recognises the need to maintain a balance between central and local 
input into the development of DCR systems. We acknowledge the success of NPfIT’s 
national leadership in ensuring economies of scale and effective contract 
management. However, we disagree that this highly centralised approach is 
necessary to ensure consistent development of new systems across the NHS, 
provided that sufficient attention is given to nationally agreed technical and clinical 
standards. It is also clear that centrally driven implementation of local systems has 
stifled local activity and caused frustration and resentment at trust level. The 
successful delivery of DCR systems depends upon the ability of Connecting for 
Health to harness the benefits from local as well as national input, something which 
it has not achieved so far. (Paragraph 235) 


There are already signs of a change of approach to increase local ownership of system 
implementation. Accountability is being devolved through the NPfIT Local 
Ownership Programme and control for some users is being increased through GP 
Systems of Choice. These measures are welcome but overdue. There is a need to go 
further and faster with reforms of this type. We recommend that: 


‘ Connecting for Health devolve responsibility for performance managing 
implementation of all NPfIT systems to Strategic Health Authorities (SHAs); 


e  SHAs devolve responsibility for operational deployment by giving individual 
hospital trusts control over implementing their own new systems. SHAs 
should also devolve responsibility for implementing shared record systems 
across local health communities to their constituent Primary Care Trusts 
(PCTs); 


e  SHAs, PCTs and hospital trusts be given the authority to negotiate directly 
with LSPs and to hold suppliers to account, so that local organisations are not 
given responsibility without power; and 


e Connecting for Health offer all local organisations a choice of systems from a 
catalogue of accredited suppliers, as far as this approach is possible within the 
limitations of existing contracts. (Paragraph 236) 


Connecting for Health’s own role should switch as soon as possible to focus on 
setting and ensuring compliance with technical and clinical standards for NHS IT 
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systems, rather than presiding over local implementation. Clear standards would 
allow systems to be accredited nationally but would also ensure that local trusts have 
a choice of system and control over implementation. (Paragraph 237) 


Technical standards should cover system security and reliability but should focus in 
particular on ensuring full interoperability between accredited systems. 
Comprehensive interoperability standards should guarantee that data can be 
seamlessly exchanged between systems whilst ensuring that users are not committed 
to a single supplier. In order to develop transparent technical standards, we 
recommend that Connecting for Health: 


° Establish an independent technical standards body responsible for setting the 
interoperability requirements for data exchange for all systems deployed in 
the NHS. These standards should be published and subjected to full external 
scrutiny; 


° Require all system suppliers to the NHS to meet and demonstrate conformity 
with these standards. Systems should be “kite marked” or classified to give 
details of their compatibility; and 


¢ Work with industry and academia to establish an independent technical 
standards testing service to evaluate and accredit systems for use in the NHS. 
(Paragraph 238) 


Safe and effective data sharing, the fundamental aim of DCR systems, also requires a 
more standardised approach to the recording of clinical information. Such an 
approach is at the heart of ensuring real interoperability between systems and is vital 
if data from DCR systems is to be used as a basis either for the SCR or for research. 
The NHS Data Dictionary and the SNOMED CT coding system are important to 
achieving more consistent recording of patient information. We recommend that 
Connecting for Health publish a timetable for introducing SNOMED CT across the 
NHS. (Paragraph 239) 


But Connecting for Health must do much more to ensure that the recording of 
detailed clinical data is standardised. Professionally developed datasets and agreed 
approaches to the structure and content of detailed records are urgently needed for 
each of the main clinical specialties and for use in a range of different care settings. 
Developing such standards will require close collaboration with Royal Colleges and 
other professional bodies. We recommend that Connecting for Health work with 


professional groups to: 
. Identify the information standards which will be required within their 
specialty area; and 
¢ Develop and implement consensus-based clinical information standards. 


(Paragraph 240) 


Separate clinical records on an individual patient can only be combined safely if each 
person can be accurately identified. The introduction of the new NHS number as the 
unique patient identifier and its allocation at birth through NHS Numbers for Babies 
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is therefore a significant achievement. Yet the value of this work and the future 
integrity of clinical information will be undermined if organisations are unable to 
retrieve an individual’s NHS number when they need to use it or to allocate 
temporary NHS numbers for use in emergencies. We recommend that: 


e The Department of Health set a timetable for mandating the use of the 
correct NHS number on all clinical communications, and make this a 
performance measure for all NHS organisations; 


e Processes are introduced to allow temporary NHS numbers to be allocated 
which can subsequently be reconciled with the patient’s permanent NHS 
number through the Personal Demographic Service; and 


° Systems are maintained to treat patients under a separate, pseudonymous 
NHS number where this is necessary. (Paragraph 241) 


Security, reliability and consent 


34. 


The resilience of new systems will be enhanced by distributing data across a range of 
hosting centres. Suppliers assured us that systems will be distributed in this way but 
the impact of the power failure at the Maidstone data centre, which affected 80 trusts, 
suggests otherwise. We recognise that lessons have been learned from the Maidstone 
incident. Nonetheless, we recommend that Connecting for Health instruct suppliers 
to publish details of all significant reliability problems along with a full incident log. 
(Paragraph 242) 


The sharing of unique smartcards between users is unacceptable and undermines the 
operational security of DCR systems. However, we sympathise with the A&E staff 
who shared smartcards when faced with waits of a minute or more to access their 
new PAS software. Unless unacceptably lengthy log-on times are addressed, security 
breaches are inevitable. We recommend that Connecting for Health: 


e Ensure that suppliers have clear plans for achieving access times compatible 
with realistic clinical requirements for all of their systems; and 


° Continue to monitor the potential for introducing more sophisticated access 
systems, such as facial pattern recognition, in busy areas such as A&E. 
(Paragraph 243) 


The Department has indicated that explicit consent will be required before DCR 
information can be shared between separate organisations. The Committee supports 
this approach and recommends that the consent model for the shared DCR be 
communicated to patients as clearly and as early as possible. (Paragraph 244) 


However, if sensitive information is to be stored and shared on DCR systems, it is 
important that local “sealed envelope” systems are developed and tested as soon as 
possible. We were concerned to hear that suppliers have not yet received 
specifications for local “sealed envelopes”. We recommend that Connecting for 
Health provide such specifications as a matter of urgency and set a clear timetable for 
the introduction of this technology at a local level. (Paragraph 245) 
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The Secondary Uses Service 


38. 


39. 


40. 


41. 


The Secondary Uses Service (SUS), which succeeded the NHS-Wide Clearing 
Service, has for some years helped to improve the health service by providing access 
to and analysis of data for commissioning, management and audit purposes. 
However, the development of the SCR and DCR will allow access to clinical data 
which are timelier, better integrated and of a profoundly higher quality than those 
currently available. This will transform the SUS and offers significant benefits, most 
notably for health research. In particular, if the highly detailed data captured by DCR 
systems can be made available through the SUS then the possibilities for new and 
improved research are outstanding. (Paragraph 280) 


The Department has acknowledged the need to take advantage of the research 
opportunities offered by the SUS and has established a partnership with the UK 
Clinical Research Collaboration to achieve this. We welcome this, but researchers 
nevertheless told us that much more could be done to maximise these opportunities. 
We recommend that Connecting for Health: 


° Mandate the use of the unique patient identifier, the NHS number, in all 
health service interactions in England; 


° Develop appropriate linkage between databases within and beyond the SUS. 
This would also have benefits for non-research activities such as health 
protection; 


° Ensure that the development of clinical information standards, which we 
recommended in Chapter 4, takes account of the needs of research; and 


. Initiate a campaign of public engagement so that both the opportunities and 
risks from using health data for research purposes are better understood. 
(Paragraph 281) 


Increasing access to health data brings new challenges for safeguarding patient 
privacy. It is therefore vital that the systems which regulate availability of, and access 
to, data through the SUS are safe and effective. Governance systems must strike a 
difficult balance between the need to protect patient privacy and the need to take 
advantage of the increasing availability of data, between safeguarding individual 
rights and promoting the public good. Unless such a balance can be struck, there is a 
risk either that the potential of the SUS will not be realised, or that public confidence 
will be damaged. (Paragraph 282) 


There are a number of weaknesses within current access and governance systems. 
While explicit patient consent is the ideal means of allowing access to data, it is often 
impossible to ask for consent in practice, particularly for studies using historical data. 
Pseudonymisation is a good idea in principle, but full pseudonymisation is only 
possible in some situations because potentially identifying data are often needed for 
effective research. It follows that some research will continue to require access to 
partially pseudonymised data in situations where obtaining explicit consent is 
impossible. However, the Patient Information Advisory Group (PIAG), which 
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considers such requests, remains a temporary body. PIAG has attracted criticism 
both for its processes and for its decisions. (Paragraph 283) 


There is an urgent need to address these problems, especially as the amount and type 
of data potentially available through the SUS will proliferate rapidly in future. We 
recommend that the Department of Health conduct a review of both national and 
local procedures for controlling access to electronic health data for “secondary” uses. 
In particular, the review should examine: 


How best to balance the opportunity to improve access to data for research 
purposes with the ongoing need to safeguard patient privacy; 


Whether to establish a national Information Governance Board to oversee 
the arrangements for access to data for secondary uses; 


The case for establishing a permanent body to succeed the Patient 
Information Advisory Group and whether this should be a subcommittee of 
the national Board; 


The effectiveness of the pseudonymisation process proposed by Connecting 
for Health and its suppliers, which should be subject to independent public 
evaluation; 


What compensating controls, such as third party brokerage, should be used 
to protect patient privacy in situations where research must be conducted 
with partially rather than fully pseudonymised information; and 


How governance arrangements for access to data for research purposes 
should differ from those which apply to other “secondary” purposes, such as 
immigration and counter-terrorism. (Paragraph 284) 
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Glossary 


AMS 
BMA 
CfH 
CHI 
OG 
DCR 
DH 
DMP 
e-GIF 
EPR 
ETP 
FIPR 
GPSoC 
HES 
ICO 
LSP 
N3 
NAO 
NCRS 
NLOP 
NPfIT 
NWCS 
PACS 
PAS 
ECE 
PDS 
RCP 
SCR 
SHA 


Academy of Medical Sciences 

British Medical Association 

Connecting for Health 

Canada Health Infoway 

Computer Sciences Corporation 

Detailed Care Record 

Department of Health 

Dossier Médicale Personnel 
e-Government Interoperability Framework 
Electronic Patient Record 

Electronic Transfer of Prescription 
Foundation for Information Policy Research 
GP Systems of Choice 

Hospital Episode Statistics 

Information Commissioner’s Office 

Local Service Provider 

The New National Network for the NHS 
National Audit Office 

NHS Care Records Service 

NPfIT Local Ownership Programme 
National Programme for IT in the NHS 
NHS-Wide Clearing Service 

Picture Archiving and Communication System 
Patient Administration System 

Primary Care Trust 

Personal Demographics Service 

Royal College of Physicians 

Summary Care Record 

Strategic Health Authority 


SNOMED CT Systematised Nomenclature of Medicine Clinical Terms 


SUS 


UKCRC 


Secondary Uses Service 
UK Clinical Research Collaboration / UK Computing Research 
Committee 
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Formal minutes 


Wednesday 25 July 2007 
Members present: 


Mr Kevin Barron, in the Chair 


Mr David Amess 


Dr Doug Naysmith 
Charlotte Atkins Mike Penning 
Mr Ronnie Campbell Mr Lee Scott 
Jim Dowd Dr Howard Stoate 
Sandra Gidley Dr Richard Taylor 


Draft Report (The Electronic Patient Record), proposed by the Chairman, brought up and 


read. 


Motion made, and Question proposed, That the draft Report be read a second time, 


paragraph by paragraph.—(The Chairman.) 


The Committee divided, 


Ayes, 7 

Charlotte Atkins 

Mr Ronnie Campbell 
Jim Dowd 

Sandra Gidley 

Dr Doug Naysmith 
Dr Howard Stoate 
Dr Richard Taylor 


Paragraphs 1 to 284 read. 


Noes, 3 

Mr David Amess 
Mike Penning 
Mr Lee Scott 


Motion made, and Question proposed, That paragraphs 1 to 284 stand part of the 


Report.—(The Chairman.) 


The Committee divided, 
Ayes, 7 Noes, 3 
Charlotte Atkins Mr David Amess 
Mr Ronnie Campbell Mike Penning 
Jim Dowd Mr Lee Scott 
Sandra Gidley 
Dr Doug Naysmith 
Dr Howard Stoate 


Dr Richard Taylor 
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Summary read. 


Motion made, and Question proposed, That the Summary be agreed to.—(The Chairman.) 


The Committee divided, 


Ayes, 7 Noes, 3 
Charlotte Atkins Mr David Amess 
Mr Ronnie Campbell Mike Penning 
Jim Dowd Mr Lee Scott 
Sandra Gidley 

Dr Doug Naysmith 

Dr Howard Stoate 

Dr Richard Taylor 


Motion made, and Question proposed, That the Report be the Sixth Report of the 
Committee to the House.—(The Chairman.) 


The Committee divided, 


Ayes, 7 Noes, 3 
Charlotte Atkins Mr David Amess 
Mr Ronnie Campbell Mike Penning 
Jim Dowd Mr Lee Scott 
Sandra Gidley 

Dr Doug Naysmith 

Dr Howard Stoate 

Dr Richard Taylor 


Ordered, That the Chairman make the Report to the House. 


Ordered, That embargoed copies of the Report be made available, in accordance with the 
provisions of Standing Order No. 134. 


Several Memoranda were ordered to be reported to the House for printing with the Report. 


Several Memoranda were ordered to be reported to the House for placing in the Library 
and Parliamentary Archives. 


[Adjourned till Thursday 11 October 2007 at 9.30am 
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Witnesses 


Thursday 26 April 2007 


Richard Granger, Director General of IT for the NHS, Harry Cayton, National 
Director for Patients and the Public, Department of Health, and Dr Gillian 
Braunold, National Clinical Lead for GPs, Connecting for Health 


Dr Paul Cundy, Chair, General Practitioners’ Joint IT Committee, Dr Martyn 
Thomas, visiting Professor of Software Engineering, University of Oxford, 
and Andrew Hawker, NHS patient 


Thursday 10 May 2007 


Professor Douwe Korff, Professor of International Law, London 
Metropolitan University, Joyce Robins, Co-Director, Patient Concern, and 
Jonathan Bamford, Assistant Information Commissioner, Information 
Commissioner's Office 


Guy Hains, President, Europe Group, Computer Sciences Corporation, 
Professor Brian Randell, Professor of Computing Science, University of 
Newcastle, and Dr Rob Hale, Confidentiality Working Group, Royal College 
of Psychiatrists 


Thursday 7 June 2007 


Professor Simon Wessely, Academy of Medical Sciences, Dr Mark Walport, 
Director, The Wellcome Trust, and Professor Carol Dezateux, Head of the 
MRC Centre for Paediatric Epidemiology and Biostatistics, Institute of Child 
Health 


Patrick O’Connell, Managing Director, BT Health, Alan Shackman, 
Independent IT Consultant, and Professor Naomi Fulop, Chair of Health and 
Health Policy, King’s College London 


Thursday 14 June 2007 


Professor John Feehally, President, The Renal Association, Dr Gill Markham, 
Vice President, The Royal College of Radiologists, and Frank Burns, Former 
CEO, Wirral Hospital NHS Trust 


Lord Hunt of Kings Heath, Minister of State for Quality, Richard Granger, 
Director General of IT for the NHS, and Dr Simon Eccles, National Clinical 
Lead for Hospital Doctors, Department of Health 
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